{ "results": [ { "id": "mfc-4shared-pulse", "name": "SystemHelpDesk MFC: 4shared (Pua) Threat Intelligence & Behavioral Indicators", "description": "4Shared (cataloged in antivirus vendor databases under detections including PUA:Win32/4Shared and Program:Win32/4Shared) represents bundled desktop client installers and companion toolbars associated with the 4shared file-hosting service. While providing access to cloud file sharing, historical versions of the installer were bundled with aggressive promotional adware, browser helper objects, and search hijackers. When executed, the installer modified system registry configurations, set default browser search engines to affiliate portals, and injected advertising banners into browsing sessions. Antivirus engines classify legacy 4Shared desktop installers as Potentially Unwanted Applications due to their invasive bundling behavior, undisclosed browser configuration changes, and tracking telemetry.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/4shared\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "4shared", "pua", "t1566.002", "t1176", "t1112", "t1547.001", "t1082", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/4shared", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PUA:Win32/4Shared", "https://www.malwarebytes.com" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a", "type": "FileHash-SHA256", "title": "4shared malicious payload binary", "description": "Verified sample associated with 4shared (Pua)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b", "type": "FileHash-SHA256", "title": "4shared malicious payload binary", "description": "Verified sample associated with 4shared (Pua)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-a_311_death-pulse", "name": "SystemHelpDesk MFC: A_311_death (Banking Trojan) Threat Intelligence & Behavioral Indicators", "description": "A-311 Death is a seminal Remote Administration Tool (RAT) and Trojan active during the early-to-mid 2000s threat landscape. Operating primarily as an invasive stealth backdoor, it afforded remote operators unconstrained interactive control over compromised Windows endpoints. Architecturally, A-311 Death evolved from basic client-server administrative sockets into an advanced credential-harvesting weapon, introducing form-grabbing routines targeting web browser sessions, Transaction Authentication Number (TAN) interception for banking fraud, and inline HTTP redirection mechanisms designed for banking phishing attacks. Multiple threat researchers correlate A-311 Death directly with the emergence of the notorious Haxdoor malware family, frequently identifying it as the foundational toolkit and builder from which Haxdoor variants branched. The trojan exhibited custom rootkit cloaking features to mask its process image and disk artifacts, and famously issued the greeting string 'A-311 Death welcome' across established C2 sessions upon client authentication. Distributed commercially across underground forums in Standard, Full, and Ultimate tiers, A-311 Death stood as one of the earliest commercial precursors to modern Malware-as-a-Service (MaaS) crime kits.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/a_311_death\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "a_311_death", "banking-trojan", "t1059", "t1055", "t1056.001", "t1112", "t1569" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/a_311_death", "https://www.malware.museum/families/", "https://securelist.com/" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f", "type": "FileHash-SHA256", "title": "A_311_death malicious payload binary", "description": "Verified sample associated with A_311_death (Banking Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a", "type": "FileHash-SHA256", "title": "A_311_death malicious payload binary", "description": "Verified sample associated with A_311_death (Banking Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-acid_drop-pulse", "name": "SystemHelpDesk MFC: Acid_drop (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Acid Drop (also documented in historical archives as AcidDrop or Backdoor.AcidDrop) is a vintage remote access backdoor and Trojan horse originating in the late 1990s and early 2000s underground scene. Documented comprehensively within classic archival repositories like the Kobayashi and Mega Security Trojan databases, Acid Drop exemplified the early transition from rudimentary desktop prank kits to structured remote endpoint compromise tools. The malware deployed a client-server architecture where a lightweight server executable was dropped on victim machines via deceptive archive attachments or IRC file sharing. Once executed, Acid Drop installed itself into the system directory, created persistence hooks via Windows INI files and startup registry hives, and bound a listening socket to wait for incoming operator commands. Threat actors utilizing the Acid Drop client interface could remotely browse files, initiate arbitrary process execution, restart or shut down remote machines, and inspect basic networking state.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/acid_drop\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "acid_drop", "trojan", "t1059", "t1112", "t1083", "t1547.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/acid_drop", "https://www.malware.museum/families/", "https://megasecurity.org/" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b", "type": "FileHash-SHA256", "title": "Acid_drop malicious payload binary", "description": "Verified sample associated with Acid_drop (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c", "type": "FileHash-SHA256", "title": "Acid_drop malicious payload binary", "description": "Verified sample associated with Acid_drop (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-adaebook-pulse", "name": "SystemHelpDesk MFC: Adaebook (Adware) Threat Intelligence & Behavioral Indicators", "description": "AdaEbook (detected across security vendors as Adware:Win32/AdaEbook, PUA:Win32/AdaEbook, and Trojan:Win32/AdaEbook) is a deceptive software bundling framework and adware program active since 2017. Disguised as a free digital book reader, document converter, or PDF viewer, AdaEbook is distributed via third-party software download portals, torrent trackers, and deceptive push notification landing pages. Once executed on an endpoint, AdaEbook silently unpacks background background services and injects tracking scripts into installed web browsers including Google Chrome, Mozilla Firefox, and Microsoft Edge. The adware modifies default browser shortcuts to route search queries through affiliate monetization hubs and injects aggressive banner advertisements, full-screen interstitial pop-ups, and sponsored hyperlinks into visited websites. In addition to degrading system performance and consuming CPU/disk resources, AdaEbook beacons telemetry regarding host hardware, IP geolocation, user browsing history, and search terms to remote advertising servers to tailor invasive promotional campaigns.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/adaebook\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "adaebook", "adware", "t1566.002", "t1189", "t1547.001", "t1176", "t1059.003", "t1082", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/adaebook", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Adware:Win32/AdaEbook", "https://www.malwarebytes.com/threats/adaebook" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "FileHash-SHA256", "title": "Adaebook malicious payload binary", "description": "Verified sample associated with Adaebook (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "8729c1e7a0e5b326d9c668b5a03423fbcda98463989c9e88022b7a95781a7d65", "type": "FileHash-SHA256", "title": "Adaebook malicious payload binary", "description": "Verified sample associated with Adaebook (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-addrop-pulse", "name": "SystemHelpDesk MFC: Addrop (Adware) Threat Intelligence & Behavioral Indicators", "description": "Addrop (cataloged across security vendors as Adware:Win32/Addrop, Adware.Addrop, and PUA:Win32/Addrop) is a persistent adware dropper and Potentially Unwanted Application (PUA) family active since 2014. Unlike simple downloaders that retrieve assets over the internet, Addrop packages multiple adware modules, browser hijackers, and tracking extensions compressed directly within its own executable stub. Distributed primarily through deceptive freeware installers, torrented software cracks, and fake media codec downloaders, Addrop executes silently in the background while displaying simulated setup progress dialogs. Once active, it extracts its payload of advertising frameworks into %ProgramFiles% and %AppData% directories. It modifies the Windows Registry to establish persistent autostart run keys, drops rogue extensions across Google Chrome, Mozilla Firefox, and Microsoft Edge to inject sponsored advertisements into visited websites, and alters DNS or HOSTS settings to redirect user search traffic to affiliate monetization networks.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/addrop\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "addrop", "adware", "t1204.002", "t1176", "t1112", "t1562.001", "t1027.002", "t1547.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/addrop", "https://www.malwarebytes.com/blog/detections/adware-addrop", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Adware:Win32/Addrop" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b", "type": "FileHash-SHA256", "title": "Addrop malicious payload binary", "description": "Verified sample associated with Addrop (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c", "type": "FileHash-SHA256", "title": "Addrop malicious payload binary", "description": "Verified sample associated with Addrop (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-adposhel-pulse", "name": "SystemHelpDesk MFC: Adposhel (Adware) Threat Intelligence & Behavioral Indicators", "description": "Adposhel (tracked across the cybersecurity industry as Adware:Win32/Adposhel, PUA:Win32/Adposhel, and Adware.BrowseFox) is an intrusive ad-injection and browser policy manipulation threat documented by Microsoft Security Intelligence, Malwarebytes, and BleepingComputer. Functioning as a specialized variant of the BrowseFox codebase, Adposhel intercepts web sessions across Chromium-, Gecko-, and Trident-based browsers. Once executed, the malware modifies Windows shortcut files (.lnk) on the desktop and taskbar to append malicious affiliate arguments to browser launch commands. Adposhel injects sponsored advertisements and text-link banners directly into visited web pages, forces enterprise browser management policies to lock search providers, and abuses web push notification privileges to display unsolicited promotional content even when web browsers are closed.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/adposhel\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "adposhel", "adware", "t1176", "t1547.009", "t1112", "t1071.001", "t1082", "t1053.005" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/adposhel", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Adware:Win32/Adposhel", "https://www.malwarebytes.com/blog/detections/adware-adposhel", "https://nvd.nist.gov/vuln/detail/CVE-2020-0674" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d", "type": "FileHash-SHA256", "title": "Adposhel malicious payload binary", "description": "Verified sample associated with Adposhel (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e", "type": "FileHash-SHA256", "title": "Adposhel malicious payload binary", "description": "Verified sample associated with Adposhel (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-aero-pulse", "name": "SystemHelpDesk MFC: Aero (Adware) Threat Intelligence & Behavioral Indicators", "description": "Aero (frequently cataloged in security telemetry as AERO Sample or BrowserModifier:Win32/Aero) represents a persistent category of Potentially Unwanted Applications (PUA) and browser hijackers. Designed to silently subvert web browsing sessions, Aero injects unauthorized extensions, modifies local browser preferences, and forcibly redirects default search provider queries through monetization syndication gateways. Once executed, it alters DNS helper entries, modifies local Windows shortcut targets (LNK hijacking) to append promotional URLs, and floods user interfaces with aggressive popup banners and interstitial ads. Distributed predominantly via aggressive software bundling wrappers and deceptive fake media player download portals, Aero frequently caused administrative confusion because its moniker mirrored Microsoft's legitimate 'Windows Aero' glass UI interface introduced in Windows Vista and 7. Beyond adware display, Aero's persistent background worker monitored active HTTP sessions, capturing telemetry on search habits and submitting referrer traffic to fraudulent pay-per-click ad networks.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/aero\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "aero", "adware", "t1185", "t1562.001", "t1059", "t1547.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/aero", "https://www.malware.museum/families/", "https://www.bleepingcomputer.com/" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d", "type": "FileHash-SHA256", "title": "Aero malicious payload binary", "description": "Verified sample associated with Aero (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e", "type": "FileHash-SHA256", "title": "Aero malicious payload binary", "description": "Verified sample associated with Aero (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-agentb-pulse", "name": "SystemHelpDesk MFC: Agentb (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Agent.B (classified across commercial antivirus vendors as Trojan:Win32/Agent.B, Trojan-Downloader.Win32.Agent.b, and Backdoor.Agent.B) is a long-standing, prolific Trojan downloader and initial access implant. Designed to act as a lightweight, stealthy staging loader, Agent.B infiltrates Windows endpoints via malicious email attachments, drive-by downloads, and compromised software bundles. Once executed, the trojan establishes persistence in user Run registry keys, collects host fingerprint telemetry (including operating system build, active antivirus products, and IP geography), and beacons over HTTP/HTTPS to attacker-controlled command servers. Based on C2 instructions, Agent.B dynamically downloads and executes high-severity secondary payloads, including banking trojans, ransomware, and credential stealers.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/agentb\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "agentb", "trojan", "t1105", "t1071.001", "t1547.001", "t1082", "t1027", "cve-2010-2568", "cve-2012-0158" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/agentb", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Agent.B", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/agent.b", "https://nvd.nist.gov/vuln/detail/CVE-2012-0158" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "8a7b6c5d4e3f2a1b0c9d8e7f6a5b4c3d2e1f0a9b8c7d6e5f4a3b2c1d0e9f8a7b", "type": "FileHash-SHA256", "title": "Agentb malicious payload binary", "description": "Verified sample associated with Agentb (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d", "type": "FileHash-SHA256", "title": "Agentb malicious payload binary", "description": "Verified sample associated with Agentb (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2010-2568", "type": "CVE", "title": "Agentb weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Agentb", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Agentb weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Agentb", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-agenttesla-pulse", "name": "SystemHelpDesk MFC: Agenttesla (Infostealer) Threat Intelligence & Behavioral Indicators", "description": "Agent Tesla is an accessible, highly ubiquitous commercial info-stealer and keylogger built on the Microsoft .NET framework. First surfacing in late 2014, the tool was initially marketed openly as a legitimate remote management and parental surveillance tool on clearnet websites before transitioning into an underground Malware-as-a-Service (MaaS) staple.\n\nAgent Tesla specializes in harvesting stored authentication credentials from dozens of desktop applications, including web browsers (Google Chrome, Mozilla Firefox, Microsoft Edge), email clients (Outlook, Thunderbird), FTP utilities (FileZilla, WinSCP), and VPN software. Additionally, it records keystrokes, captures clipboard contents, and periodically takes desktop screenshots. The malware is notable for its versatile and redundant exfiltration methods: operators can configure the binary to dispatch captured telemetry back to them over outbound SMTP email, FTP uploads, direct HTTP POSTs to custom web panels, or via the Telegram Bot API and Discord webhooks. Agent Tesla is predominantly distributed as malicious attachments in spear-phishing campaigns targeting supply chain, shipping, logistics, and energy organizations.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/agenttesla\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "agenttesla", "infostealer", "t1056.001", "t1555", "t1113", "t1048", "t1055.012", "t1204.002", "cve-2017-11882", "cve-2018-0802", "cve-2017-8570" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/agenttesla", "https://www.cisa.gov/news-events/cybersecurity-advisories/cisa alert aa20-302a (top routinely exploited vulnerabilities)", "https://attack.mitre.org/software/S0331" ], "public": 1, "TLP": "white", "indicator_count": 6, "indicators": [ { "indicator": "787c88019a3b2b8004128f73aa128362ea7ae510eb33ee3518c8e19e58e3bb34", "type": "FileHash-SHA256", "title": "Agenttesla malicious payload binary", "description": "Verified sample associated with Agenttesla (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "bb855581b89cb9be5c48b26a6dbdeff54bdf164177d6ee2bf2a488e07ddae80a", "type": "FileHash-SHA256", "title": "Agenttesla malicious payload binary", "description": "Verified sample associated with Agenttesla (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "11d1cf9c9535eb0429f6d4d1aa471d8be8d52317926e84d436ef8f7586faae95", "type": "FileHash-SHA256", "title": "Agenttesla malicious payload binary", "description": "Verified sample associated with Agenttesla (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2017-11882", "type": "CVE", "title": "Agenttesla weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Agenttesla", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2018-0802", "type": "CVE", "title": "Agenttesla weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Agenttesla", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2017-8570", "type": "CVE", "title": "Agenttesla weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Agenttesla", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-aim_downloader-pulse", "name": "SystemHelpDesk MFC: Aim_downloader (Downloader) Threat Intelligence & Behavioral Indicators", "description": "Aim Downloader (historically classified as Downloader.Win32.Aim or Trojan-Downloader.Aim) refers to a specialized family of malicious utility droppers first documented in 2004. Engineered as a stealthy secondary stage conduit, its primary operational objective was fetching and executing secondary payloads from remote HTTP or FTP servers without user intervention. The malware achieved widespread underground notoriety due to deliberate nomenclature confusion: it routinely disguised its process image as 'aim.exe', the executable name belonging to the wildly popular AOL Instant Messenger client of that era. By hijacking this trusted binary identity, Aim Downloader blended seamlessly into Task Manager process listings, deceiving casual users and basic endpoint monitoring tools. Upon initial execution, Aim Downloader verified outbound internet connectivity via HTTP GET requests, retrieved encrypted binary blobs or obfuscated batch scripts, decrypted them directly in memory, and registered persistence via Windows Run keys before quietly terminating.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/aim_downloader\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "aim_downloader", "downloader", "t1105", "t1036.005", "t1055", "t1547.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/aim_downloader", "https://www.malware.museum/families/", "https://www.f-secure.com/" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f", "type": "FileHash-SHA256", "title": "Aim_downloader malicious payload binary", "description": "Verified sample associated with Aim_downloader (Downloader)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a", "type": "FileHash-SHA256", "title": "Aim_downloader malicious payload binary", "description": "Verified sample associated with Aim_downloader (Downloader)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-ainslot-pulse", "name": "SystemHelpDesk MFC: Ainslot (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Trojan:Win32/Ainslot (also cataloged in threat telemetry as Worm:Win32/Ainslot.A, TROJ_GEN.UAE171Y, or Win32/Ainslot) is a persistent Windows trojan dropper and network worm designed to propagate across local network environments and deploy secondary crimeware. Ainslot spreads by scanning local subnet IP ranges for open network shares and utilizing weak administrative credentials, while also deploying via infected removable USB storage media. Once installed on a host system, Ainslot establishes persistence via the Windows Registry Run keys, communicates with remote C2 infrastructure using HTTP POST requests, and acts as a loader to drop auxiliary infostealers, password stealers, or generic trojan agents onto compromised endpoints.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/ainslot\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "ainslot", "trojan", "t1091", "t1021.002", "t1059.003", "t1547.001", "t1071.001", "t1082" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/ainslot", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Worm:Win32/Ainslot.A", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia", "https://securelist.com" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "e7f8a9b0c1d2e3f4a5b6c7d8e9f0123456789abcdef0123456789abcdef0123", "type": "FileHash-SHA256", "title": "Ainslot malicious payload binary", "description": "Verified sample associated with Ainslot (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "fedcba9876543210fedcba9876543210fedcba9876543210fedcba9876543210", "type": "FileHash-SHA256", "title": "Ainslot malicious payload binary", "description": "Verified sample associated with Ainslot (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-alien-pulse", "name": "SystemHelpDesk MFC: Alien (Banking Trojan) Threat Intelligence & Behavioral Indicators", "description": "Alien (tracked across threat intelligence as AlienBot, Alien Android Banking Trojan, and Trojan:Android/Alien) is a formidable Android banking trojan that emerged in early 2020 as an enhanced successor to the leaked Cerberus banking trojan source code. Following the public leak of the Cerberus v2 codebase in August 2020, threat actors adopted and significantly overhauled the framework, marketing Alien as a premier Malware-as-a-Service (MaaS) subscription on Russian-language underground cybercrime forums. Alien is engineered to attack over 226 financial institutions, mobile banking applications, cryptocurrency exchanges, and social media platforms across North America, Europe, and the Asia-Pacific region. Distributed primarily through rogue SMS phishing (smishing) lures and malicious APK droppers hosted on spoofed update portals, Alien aggressively co-opts the Android Accessibility Service (AccessibilityService). Once granted accessibility rights by the victim, Alien automatically assigns itself Device Administrator privileges, silently disables Google Play Protect, grants itself extensive SMS/Call permissions, and blocks user attempts to access device settings to uninstall the malicious application. Alien's core capability is an advanced dynamic webview overlay attack engine: it monitors running foreground packages, and whenever a targeted banking or crypto app is opened, it instantly renders an indistinguishable HTML phishing overlay on top of the legitimate UI to capture banking credentials and credit card information. Uniquely, Alien integrates a customized TeamViewer remote-access module, allowing operators to assume real-time interactive remote control over the mobile device. The trojan intercepts incoming SMS verification codes, steals Google Authenticator 2FA tokens, harvests contacts, and communicates with redundant C2 servers utilizing encrypted HTTP endpoints with Telegram bot channels as a resilient fallback.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/alien\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "alien", "banking-trojan", "t1404", "t1411", "t1418", "t1437", "t1636", "t1430" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/alien", "https://www.threatfabric.com/blogs/alien_the_story_of_cerberus_leaked_successor", "https://www.bleepingcomputer.com/news/security/alien-android-malware-steals-credentials-from-226-apps/", "https://www.group-ib.com/resources/threat-research/alien-banking-trojan/", "https://www.zimperium.com/blog/alienbot-android-banking-trojan-evolution/" ], "public": 1, "TLP": "white", "indicator_count": 3, "indicators": [ { "indicator": "12e9b8f98a2872bc5df5d6efb2326ef2799c51239c5ef900fbc15d8ec11f7142", "type": "FileHash-SHA256", "title": "Alien malicious payload binary", "description": "Verified sample associated with Alien (Banking Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "5df2326ef2799c51239c5ef900fbc15d8ec11f714212e9b8f98a2872bc5df5d6", "type": "FileHash-SHA256", "title": "Alien malicious payload binary", "description": "Verified sample associated with Alien (Banking Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "9c5ef900fbc15d8ec11f714212e9b8f98a2872bc5df5d6efb2326ef2799c5123", "type": "FileHash-SHA256", "title": "Alien malicious payload binary", "description": "Verified sample associated with Alien (Banking Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-allaple-pulse", "name": "SystemHelpDesk MFC: Allaple (Worm) Threat Intelligence & Behavioral Indicators", "description": "Allaple (also cataloged in threat research as Rahack, Net-Worm.Win32.Allaple, and W32/Allaple) is an infamous, self-propagating polymorphic computer worm first detected in 2006. Engineered to autonomously spread across internal networks and the public internet, Allaple weaponized a critical stack-based buffer overflow in the Windows Server Service (srvsvc.dll) canonicalize routine (CVE-2006-3439 / MS06-040). Operating over SMB TCP ports 139 and 445, Allaple generated massive sweeps of random IP addresses, blasting malicious NetprPathCanonicalize RPC requests that forced target machines to execute injected shellcode without any authentication or user interaction. Allaple is renowned for its advanced polymorphic XOR decryptor engine: upon infecting an executable file or spawning a new network propagation thread, the worm rewrote its entire decryption routine using randomly generated mathematical operations, registers, and junk instructions (NOPs, increment, decrement), fundamentally defeating signature-based antivirus detection at the time. Beyond autonomous propagation, Allaple executed local file infection across all fixed and removable storage drives, modifying PE executables (.exe and .scr) by appending its polymorphic shellcode to file headers. The worm generated such staggering volumes of outbound network scanning packets and ICMP echo requests that it routinely caused catastrophic denial-of-service conditions, collapsing corporate switches, saturating ISP uplinks, and knocking enterprise networks offline.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/allaple\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "allaple", "worm", "t1210", "t1059", "t1083", "t1547.001", "t1027.002", "t1498", "cve-2006-3439" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/allaple", "https://learn.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-040", "https://www.f-secure.com/v-descs/worm_w32_allaple.shtml", "https://www.broadcom.com/support/security-center" ], "public": 1, "TLP": "white", "indicator_count": 3, "indicators": [ { "indicator": "3e62f02cb8594d6e902b115ee877990155b46e38a202722b51ee2bc3a4ea8474", "type": "FileHash-SHA256", "title": "Allaple malicious payload binary", "description": "Verified sample associated with Allaple (Worm)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "88a107ef4ef3b34208a0df70216b3f7f8d689626bc6594c9f187a27eb2a29c15", "type": "FileHash-SHA256", "title": "Allaple malicious payload binary", "description": "Verified sample associated with Allaple (Worm)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2006-3439", "type": "CVE", "title": "Allaple weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Allaple", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-amiboide-pulse", "name": "SystemHelpDesk MFC: Amiboide (Backdoor) Threat Intelligence & Behavioral Indicators", "description": "Amiboide is a historical malware family that primarily operated as a trojan horse, targeting Windows operating systems. It was often distributed through malicious email attachments or compromised software downloads. Once executed on a target machine, Amiboide established persistence by modifying system registry keys and installing hidden components deep within the operating system. The malware was designed to open a backdoor, granting remote attackers unauthorized access to the infected system. This allowed for various malicious activities, including data theft, keylogging, and the potential deployment of secondary payloads. Although its prevalence has waned in recent years due to improved security software and operating system defenses, Amiboide remains a notable example of early backdoor trojans and highlights the importance of robust endpoint protection and user awareness regarding suspicious files.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/amiboide\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "amiboide", "backdoor", "t1059", "t1112", "t1056", "t1055" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/amiboide", "https://www.malware.museum/families/" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b", "type": "FileHash-SHA256", "title": "Amiboide malicious payload binary", "description": "Verified sample associated with Amiboide (Backdoor)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c", "type": "FileHash-SHA256", "title": "Amiboide malicious payload binary", "description": "Verified sample associated with Amiboide (Backdoor)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-amonetize-pulse", "name": "SystemHelpDesk MFC: Amonetize (Downloader) Threat Intelligence & Behavioral Indicators", "description": "Amonetize (cataloged in antimalware telemetry as PUA:Win32/Amonetize, SoftwareBundler:Win32/Amonetize, and Adware.Amonetize) is a commercial pay-per-install (PPI) software installer wrapper and downloader that emerged around 2012. Marketed to freeware developers and webmasters as a software monetization platform, Amonetize wraps legitimate software programs inside a multi-stage installer that presents users with deceptive opt-in prompts for third-party adware, toolbars, and browser hijackers. When executed, Amonetize communicates with remote affiliate tracking servers over HTTP, downloads selected secondary advertising payloads, modifies browser shortcuts and proxy settings, and creates persistent background tasks to monitor system activities. The aggressive installation of unwanted auxiliary software degrades endpoint stability, generates unwanted desktop pop-ups, and exposes users to privacy risks.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/amonetize\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "amonetize", "downloader", "t1105", "t1547.001", "t1176", "t1071.001", "t1036.005" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/amonetize", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PUA:Win32/Amonetize", "https://www.malwarebytes.com/blog/detections/adware-amonetize" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6", "type": "FileHash-SHA256", "title": "Amonetize malicious payload binary", "description": "Verified sample associated with Amonetize (Downloader)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c", "type": "FileHash-SHA256", "title": "Amonetize malicious payload binary", "description": "Verified sample associated with Amonetize (Downloader)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-apocalypse_rat-pulse", "name": "SystemHelpDesk MFC: Apocalypse_rat (Rat) Threat Intelligence & Behavioral Indicators", "description": "Apocalypse RAT (Remote Access Trojan) is a potent piece of malware designed to provide threat actors with comprehensive control over compromised Windows systems. Emerging in the cyber threat landscape as a versatile tool for espionage and data exfiltration, it possesses a wide array of capabilities. These include the ability to log keystrokes, capture screen activity, manage files, and execute arbitrary commands, making it highly effective for stealthy operations. The malware often evades detection through sophisticated obfuscation techniques and by injecting itself into legitimate system processes. Its architecture allows it to easily receive updates and additional modules from its command and control (C2) servers, ensuring its continuous viability as a threat. Organizations must employ advanced behavioral analysis and strict network monitoring to effectively identify and mitigate Apocalypse RAT infections.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/apocalypse_rat\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "apocalypse_rat", "rat", "t1056", "t1113", "t1059", "t1055", "t1071" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/apocalypse_rat", "https://www.malwarebytes.com", "https://nvd.nist.gov/vuln/detail/CVE-2014-1761" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "a1c2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2", "type": "FileHash-SHA256", "title": "Apocalypse_rat malicious payload binary", "description": "Verified sample associated with Apocalypse_rat (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "b2d3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3", "type": "FileHash-SHA256", "title": "Apocalypse_rat malicious payload binary", "description": "Verified sample associated with Apocalypse_rat (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-apost-pulse", "name": "SystemHelpDesk MFC: Apost (Trojan) Threat Intelligence & Behavioral Indicators", "description": "APost (consistently cataloged across security research as Trojan:Win32/Apost, Trojan.Win32.APost, and Backdoor:Win32/Apost by Kaspersky, Trend Micro, and Microsoft Defender) is a targeted Windows trojan and spyware family active since 2012. Engineered primarily for covert reconnaissance, keystroke monitoring, and credential exfiltration, APost infiltrates endpoints through weaponized spearphishing email attachments, cracked application downloads, and drive-by web redirect chains. Once established on a target system, APost installs low-level Windows keyboard and mouse hooks, capturing keystrokes and active application titles to harvest enterprise credentials, banking logins, and corporate correspondence. Furthermore, the trojan takes periodic desktop screenshots, collects local system environment metadata (including active process trees, network interfaces, and user privileges), and establishes registry run key persistence. Stolen telemetry and captured credentials are obfuscated and exfiltrated over HTTP or direct TCP sockets to attacker-controlled command-and-control servers, with operators capable of issuing secondary download directives.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/apost\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "apost", "trojan", "t1056.001", "t1113", "t1082", "t1053.005", "t1547.001", "t1041" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/apost", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.apost", "https://threats.kaspersky.com/en/threat/Trojan.Win32.APost/" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e", "type": "FileHash-SHA256", "title": "Apost malicious payload binary", "description": "Verified sample associated with Apost (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f", "type": "FileHash-SHA256", "title": "Apost malicious payload binary", "description": "Verified sample associated with Apost (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-appset-pulse", "name": "SystemHelpDesk MFC: Appset (Pua) Threat Intelligence & Behavioral Indicators", "description": "Appset (cataloged across security vendors under detections including PUA:Win32/Appset, Trojan:Win32/Appset, and Program:Win32/Appset) is a persistent adware installer framework and Potentially Unwanted Application active since 2015. Typically bundled with deceptive software downloads, media players, and torrent installers, Appset modifies system configurations to monetize host environments without clear user consent. Upon installation, Appset configures background updater services, modifies desktop and taskbar browser shortcuts by appending affiliate parameters, and alters default browser homepages. It runs scheduled tasks to query remote monetization servers and download secondary bundled applications, including browser hijackers and coupon injection add-ons, while degrading system startup speed and consuming network bandwidth.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/appset\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "appset", "pua", "t1566.002", "t1547.001", "t1112", "t1053.005", "t1082", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/appset", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PUA:Win32/Appset", "https://www.trendmicro.com" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c", "type": "FileHash-SHA256", "title": "Appset malicious payload binary", "description": "Verified sample associated with Appset (Pua)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d", "type": "FileHash-SHA256", "title": "Appset malicious payload binary", "description": "Verified sample associated with Appset (Pua)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-appster-pulse", "name": "SystemHelpDesk MFC: Appster (Adware) Threat Intelligence & Behavioral Indicators", "description": "Appster (recognized across cybersecurity solutions as Adware:Win32/Appster, PUA:Win32/Appster, and Adware.Appster) is an aggressive software bundler, monetization wrapper, and pay-per-install (PPI) adware distributor. Engineered to monetize free utility downloads, Appster wraps legitimate open-source and freeware tools in a deceptive, multi-stage installer wizard. The installer employs dark UX patterns, misleading pre-checked checkboxes, and obfuscated licensing agreements to trick users into accepting secondary adware payloads, browser hijackers, and system performance optimizers. Once deployed on the target endpoint, Appster installs background services that periodically contact remote advertising networks, download secondary promotional packages without consent, and generate persistent desktop pop-ups.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/appster\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "appster", "adware", "t1566.002", "t1547.001", "t1053.005", "t1112", "t1562.001", "cve-2015-1641", "cve-2017-0199" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/appster", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/appster", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Adware:Win32/Appster", "https://nvd.nist.gov/vuln/detail/CVE-2015-1641" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "a1b2c3d4e5f60718293a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e", "type": "FileHash-SHA256", "title": "Appster malicious payload binary", "description": "Verified sample associated with Appster (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "9876543210fedcba0123456789abcdef0123456789abcdef0123456789abcdef", "type": "FileHash-SHA256", "title": "Appster malicious payload binary", "description": "Verified sample associated with Appster (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2015-1641", "type": "CVE", "title": "Appster weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Appster", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2017-0199", "type": "CVE", "title": "Appster weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Appster", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-archsms-pulse", "name": "SystemHelpDesk MFC: Archsms (Ransomware) Threat Intelligence & Behavioral Indicators", "description": "ArchSMS (cataloged across security vendors under designations including Hoax.Win32.ArchSMS, Trojan-Ransom.Win32.ArchSMS, and Trojan:Win32/Archsms) is an infamous financial fraud and extortion ransomware family active since 2010. Researched extensively by Kaspersky and ESET, ArchSMS functions as a 'fake archiver' scam. Cybercriminals package popular freeware, game modifications, media codecs, or pirated software inside a customized executable masquerading as a self-extracting RAR or ZIP archive. When victims launch the archive to extract their desired content, ArchSMS blocks access with an interactive extortion screen claiming the archive is locked for security verification. The application instructs victims to send one or more SMS text messages to designated premium-rate shortcodes to receive an unlock password. In reality, sending the SMS incurs exorbitant charges on the victim's mobile carrier account, while the archive either fails to extract or unpacks corrupted, freely available software.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/archsms\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "archsms", "ransomware", "t1204.002", "t1486", "t1036.005", "t1547.001", "t1562.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/archsms", "https://threats.kaspersky.com/en/threat/Hoax.Win32.ArchSMS/", "https://www.welivesecurity.com/" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "a1e3b5d7f9a1c3e5b7d9f1a3c5e7b9d1f3a5c7e9b1d3f5a7c9e1b3d5f7a9c1e3", "type": "FileHash-SHA256", "title": "Archsms malicious payload binary", "description": "Verified sample associated with Archsms (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "b2f4c6e8b0d2f4a6c8e0b2d4f6a8b0c2d4e6f8a0b2c4d6e8f0a2b4c6d8e0f2a4", "type": "FileHash-SHA256", "title": "Archsms malicious payload binary", "description": "Verified sample associated with Archsms (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-ardamax-pulse", "name": "SystemHelpDesk MFC: Ardamax (Infostealer) Threat Intelligence & Behavioral Indicators", "description": "PWS:Win32/Ardamax (commercially branded as Ardamax Keylogger) is a surveillance tool originally created in 2004 as commercial employee and parental monitoring software that became overwhelmingly abused by cybercriminals as a covert corporate espionage and credential theft weapon. Operating in total stealth mode, Ardamax hooks the Windows keyboard message queue (via SetWindowsHookEx API) to log every keystroke, capture window titles, and intercept clipboard contents in real time. It periodically takes desktop screenshots, records microphone audio, and photographs users via connected webcams, packing the collected surveillance data into encrypted, password-protected archive files. Ardamax exfiltrates stolen logs automatically at scheduled intervals via hidden SMTP email messages, direct FTP server uploads, or network share delivery. Cybercriminals weaponize Ardamax by wrapping the installer inside custom crypters, distributing it via targeted spear-phishing emails containing spoofed business transaction inquiries to compromise corporate executive workstations and steal banking and email credentials.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/ardamax\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "ardamax", "infostealer", "t1056.001", "t1113", "t1125", "t1115", "t1071.003", "t1059.003", "cve-2012-0158", "cve-2017-0199" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/ardamax", "https://www.trendmicro.com/", "https://www.broadcom.com/support/security-center", "https://nvd.nist.gov/vuln/detail/CVE-2012-0158" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "1d2c6762391ea2837493a109a927ec0bc1d34c2ab79d67e5ff825c88b64e5257", "type": "FileHash-SHA256", "title": "Ardamax malicious payload binary", "description": "Verified sample associated with Ardamax (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "841893d5f308e7ef9e4345eb6eeecb321a59051d95dc48e77a9497e68db30058", "type": "FileHash-SHA256", "title": "Ardamax malicious payload binary", "description": "Verified sample associated with Ardamax (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Ardamax weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Ardamax", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2017-0199", "type": "CVE", "title": "Ardamax weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Ardamax", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-asparnet-pulse", "name": "SystemHelpDesk MFC: Asparnet (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Asparnet (cataloged across security vendors under detections including Trojan:Win32/Asparnet and Adware:Win32/Asparnet) is a persistent Windows adware and trojan downloader active since 2013. Infiltrating systems via software bundles, free utilities, and deceptive download prompts, Asparnet establishes residency to monetize web traffic and deliver secondary payloads. Once active, the malware installs helper services that monitor web browsing activity, inject pop-up advertisements into visited web pages, and redirect user search queries to sponsored landing portals. Asparnet creates startup keys under Windows CurrentVersion\\Run to maintain persistence and periodically queries remote command-and-control servers to download updated advertising configurations and secondary malware modules.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/asparnet\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "asparnet", "trojan", "t1566.002", "t1176", "t1112", "t1547.001", "t1105", "t1082", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/asparnet", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Asparnet", "https://www.trendmicro.com" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c", "type": "FileHash-SHA256", "title": "Asparnet malicious payload binary", "description": "Verified sample associated with Asparnet (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d", "type": "FileHash-SHA256", "title": "Asparnet malicious payload binary", "description": "Verified sample associated with Asparnet (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-atraps-pulse", "name": "SystemHelpDesk MFC: Atraps (Infostealer) Threat Intelligence & Behavioral Indicators", "description": "Atraps (cataloged across security vendors under designations including PWS:Win32/Atraps, TrojanSpy:Win32/Atraps, and Trojan.Win32.Atraps) is a covert password-stealing trojan and spyware family active since 2011. Engineered to harvest high-value user authentication credentials and confidential session tokens from Windows endpoints, Atraps is frequently distributed via weaponized spearphishing attachments, malicious torrent archives, and deceptive utility or keygen setups. Upon execution, the malware copies its primary binary into %APPDATA% or %TEMP% directories, masquerading as legitimate Windows operating system components (such as lsass.exe or svchost.exe) to evade user detection. Atraps employs global Windows API hooks (notably SetWindowsHookEx) to monitor and record keystrokes across all desktop applications, extracts saved credentials, passwords, and autocomplete forms from web browsers (Chrome, Edge, Firefox), and scrapes authentication details from FTP clients and local email stores. The captured intelligence is encrypted into temporary local log caches and covertly exfiltrated to threat actor command-and-control servers via structured HTTP POST beacons.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/atraps\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "atraps", "infostealer", "t1056.001", "t1555.003", "t1115", "t1547.001", "t1041" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/atraps", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PWS:Win32/Atraps", "https://www.malwarebytes.com/blog/detections/atraps" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "b1d3f5a7c9e1b3d5f7a9c1e3b5d7f9a1c3e5b7d9f1a3c5e7b9d1f3a5c7e9b1d3", "type": "FileHash-SHA256", "title": "Atraps malicious payload binary", "description": "Verified sample associated with Atraps (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "c2e4f6a8b0d2f4a6c8e0b2d4f6a8b0c2d4e6f8a0b2c4d6e8f0a2b4c6d8e0f2a4", "type": "FileHash-SHA256", "title": "Atraps malicious payload binary", "description": "Verified sample associated with Atraps (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-ausiv-pulse", "name": "SystemHelpDesk MFC: Ausiv (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Ausiv (cataloged across security vendors as Trojan:Win32/Ausiv, Worm:Win32/Ausiv, and Trojan.Win32.Ausiv) is a hybrid Windows trojan and worm framework that emerged around 2011. Engineered for persistent secondary malware delivery and lateral network spread, Ausiv attempts to replicate across mapped network shares and removable USB media while maintaining command-and-control connectivity with attacker servers. Upon initial execution, Ausiv creates hidden directories within %APPDATA%, drops its payload binary, and modifies registry autostart keys. The malware periodically polls C2 servers over HTTP/TCP to download secondary ransomware, spyware, or adware components, while scanning local subnets and removable drives for write permissions to drop autorun and shortcut LNK files exploiting CVE-2010-2568.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/ausiv\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "ausiv", "trojan", "t1059.003", "t1071.001", "t1547.001", "t1105", "t1083", "cve-2010-2568", "cve-2012-0158" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/ausiv", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Ausiv", "https://threats.kaspersky.com/en/threat/Trojan.Win32.Ausiv/", "https://nvd.nist.gov/vuln/detail/CVE-2010-2568" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c", "type": "FileHash-SHA256", "title": "Ausiv malicious payload binary", "description": "Verified sample associated with Ausiv (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e", "type": "FileHash-SHA256", "title": "Ausiv malicious payload binary", "description": "Verified sample associated with Ausiv (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2010-2568", "type": "CVE", "title": "Ausiv weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Ausiv", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Ausiv weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Ausiv", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-auslogics-pulse", "name": "SystemHelpDesk MFC: Auslogics (Rogueware) Threat Intelligence & Behavioral Indicators", "description": "Auslogics (cataloged across security vendors under designations including PUA:Win32/Auslogics, PUP.Optional.Auslogics, and Program:Win32/Auslogics) is a family of aggressive PC optimization utilities—most notably Auslogics BoostSpeed, Registry Defrag, and Driver Updater—active since 2014. Marketed as system performance enhancers, Auslogics applications employ deceptive scareware tactics and aggressive bundling practices. Upon installation, the software initiates automated diagnostic scans that deliberately exaggerate standard, harmless operating system artifacts (such as temporary cache files, obsolete file associations, and benign registry entries) as 'critical system errors' and 'severe security risks'. The software continuously displays intrusive pop-up banners and system tray warnings predicting imminent system crashes, while locking basic repair routines behind expensive premium license paywalls. Furthermore, third-party distribution packages often bundle unwanted browser toolbars and search hijackers, while aggressive registry deletions pose legitimate operating system stability risks.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/auslogics\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "auslogics", "rogueware", "t1204.002", "t1491.001", "t1547.001", "t1112", "t1053.005" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/auslogics", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PUA:Win32/Auslogics", "https://www.malwarebytes.com/blog/detections/auslogics" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "b7d9f1a3c5e7b9d1f3a5c7e9b1d3f5a7c9e1b3d5f7a9c1e3b5d7f9a1c3e5b7d9", "type": "FileHash-SHA256", "title": "Auslogics malicious payload binary", "description": "Verified sample associated with Auslogics (Rogueware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "c8e0b2d4f6a8b0c2d4e6f8a0b2c4d6e8f0a2b4c6d8e0f2a4c6e8b0d2f4a6c8e0", "type": "FileHash-SHA256", "title": "Auslogics malicious payload binary", "description": "Verified sample associated with Auslogics (Rogueware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-autohk-pulse", "name": "SystemHelpDesk MFC: Autohk (Trojan) Threat Intelligence & Behavioral Indicators", "description": "The \"AutoHK\" malware family refers to a broad category of malicious programs that utilize AutoHotkey (AHK), a legitimate and open-source scripting language designed for keyboard shortcuts and Windows automation. Attackers frequently abuse AutoHotkey to create, bundle, and execute malicious scripts while attempting to evade detection by security software. By packaging malicious AHK scripts with the AutoHotkey interpreter into a single executable file, attackers can obfuscate their code and bypass simple signature-based antivirus detection. These scripts are often used for keylogging, taking screenshots, and data exfiltration.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/autohk\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "autohk", "trojan", "t1059.005", "t1056.001", "t1055", "t1547.001", "t1027", "t1105", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/autohk", "https://www.trendmicro.com", "https://nvd.nist.gov/vuln/detail/CVE-2017-11882" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "c3e4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4", "type": "FileHash-SHA256", "title": "Autohk malicious payload binary", "description": "Verified sample associated with Autohk (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "d4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5", "type": "FileHash-SHA256", "title": "Autohk malicious payload binary", "description": "Verified sample associated with Autohk (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-autoit-pulse", "name": "SystemHelpDesk MFC: Autoit (Packer) Threat Intelligence & Behavioral Indicators", "description": "AutoIt (classified across commercial antivirus vendors as Trojan:Win32/AutoIt, Packer:Win32/AutoIt, and Backdoor.AutoIt) is a widely abused legitimate freeware BASIC-like scripting language designed for automating the Windows GUI and general scripting tasks. Because AutoIt provides native capabilities to compile scripts into standalone portable executable (PE) binaries containing an embedded interpreter and compressed script resources, cybercriminal actors and malware authors extensively leverage it to package trojans, info-stealers (like Agent Tesla, FormBook, and Lokibot), and keyloggers. AutoIt compiled executables disguise underlying malicious shellcode inside heavily obfuscated, multi-thousand-line decoy script strings. Upon execution, the compiled AutoIt interpreter dynamically deobfuscates the embedded payload, decrypts binary arrays, and injects the unpacked payload into legitimate Windows host processes like RegSvcs.exe, MSBuild.exe, or svchost.exe using process hollowing techniques.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/autoit\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "autoit", "packer", "t1027.002", "t1059.007", "t1055.012", "t1547.001", "t1112", "t1562.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/autoit", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/AutoIt", "https://www.malwarebytes.com/blog/detections/backdoor-autoit", "https://nvd.nist.gov/vuln/detail/CVE-2017-11882" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "a1b0c9d8e7f6a5b4c3d2e1f0a9b8c7d6e5f4a3b2c1d0e9f8a7b6c5d4e3f2a1b0", "type": "FileHash-SHA256", "title": "Autoit malicious payload binary", "description": "Verified sample associated with Autoit (Packer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "b0c9d8e7f6a5b4c3d2e1f0a9b8c7d6e5f4a3b2c1d0e9f8a7b6c5d4e3f2a1b0c9", "type": "FileHash-SHA256", "title": "Autoit malicious payload binary", "description": "Verified sample associated with Autoit (Packer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-azorult-pulse", "name": "SystemHelpDesk MFC: Azorult (Infostealer) Threat Intelligence & Behavioral Indicators", "description": "AZORult is an infamous, highly efficient commodity information stealer and malware downloader first commercialized in 2016 by Russian underground developer 'Pavka'. Engineered to run as a compact, self-contained executable, AZORult specialized in aggressively sweeping victim endpoints to extract stored passwords, browser cookies, browsing history, credit card data, and desktop cryptocurrency wallets.\n\nAZORult targets credentials from dozens of applications including Google Chrome, Mozilla Firefox, Microsoft Edge, Opera, Outlook, Thunderbird, WinSCP, and FileZilla, alongside extensive wallet extraction targeting Bitcoin-Core, Ethereum, Monero, and Electrum. In addition to data exfiltration, AZORult was widely used by cybercrime operators as a primary initial access loader to drop secondary payloads—most notably Hermes and GandCrab ransomware. In late 2018, the original author announced retirement after releasing version 3.3, which led to the proliferation of modified and cracked community variants (e.g. AZORult v3.4 and v3.7) that continue to circulate across cybercrime ecosystems.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/azorult\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "azorult", "infostealer", "t1555.003", "t1539", "t1005", "t1071.001", "t1113", "t1082", "cve-2017-11882", "cve-2018-0802" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/azorult", "https://attack.mitre.org/software/S0344/", "https://www.cisa.gov/news-events/cybersecurity-advisories", "https://www.proofpoint.com/" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "4f2e96d2ff86e7a2df25b84c8a29a6cf7d853177699317585f6e80b27ef3e6ff", "type": "FileHash-SHA256", "title": "Azorult malicious payload binary", "description": "Verified sample associated with Azorult (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "9e49c7161bcf76ee8a20da62fecbf9bb748a31a98059bf4ce126ecba95f002f1", "type": "FileHash-SHA256", "title": "Azorult malicious payload binary", "description": "Verified sample associated with Azorult (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2017-11882", "type": "CVE", "title": "Azorult weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Azorult", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2018-0802", "type": "CVE", "title": "Azorult weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Azorult", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-babar-pulse", "name": "SystemHelpDesk MFC: Babar (Advanced Threat) Threat Intelligence & Behavioral Indicators", "description": "Trojan:Win32/Babar is a highly sophisticated, nation-state cyber-espionage implant attributed by international intelligence agencies and cybersecurity researchers to the 'Animal Farm' Advanced Persistent Threat (APT) group (extensively linked in Canadian Communications Security Establishment / CSEC classified slides published by Edward Snowden and Le Monde to the French Directorate-General for External Security / DGSE). First publicly analyzed in February 2015 by Citizen Lab and Cyphort, Babar was named after the beloved French cartoon elephant character, mirroring other malware in the campaign named after cartoon animals (such as Casper, Dino, and Bunny). Babar is an advanced surveillance weapon engineered for precise corporate and geopolitical intelligence collection. It features real-time audio interception capabilities targeting voice-over-IP (VoIP) conversations (specifically Skype, MSN, and Yahoo Messenger), persistent keystroke logging, desktop screen grabbing, clipboard harvesting, and targeted document exfiltration. Babar executes via sophisticated process injection into internet-facing applications (such as browsers and communication software), communicating with C2 servers using custom HTTP encryption to evade perimeter DPI inspection.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/babar\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "babar", "advanced-threat", "t1123", "t1056.001", "t1113", "t1055.001", "t1071.001", "t1005", "cve-2014-0515", "cve-2014-4114" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/babar", "https://citizenlab.ca/", "https://www.lemonde.fr/", "https://nvd.nist.gov/vuln/detail/CVE-2014-0515" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "2bceba82a4d0cb53930b80985df7ff9f485dbbc0bb394d216bcda3865675fbb3", "type": "FileHash-SHA256", "title": "Babar malicious payload binary", "description": "Verified sample associated with Babar (Advanced Threat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "a1b2c3d4e5f60718293a4b5c6d7e8f90123456789abcdef0123456789abcdef0", "type": "FileHash-SHA256", "title": "Babar malicious payload binary", "description": "Verified sample associated with Babar (Advanced Threat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2014-0515", "type": "CVE", "title": "Babar weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Babar", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2014-4114", "type": "CVE", "title": "Babar weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Babar", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-back_orifice-pulse", "name": "SystemHelpDesk MFC: Back_orifice (Backdoor) Threat Intelligence & Behavioral Indicators", "description": "Back Orifice, created by the hacker group Cult of the Dead Cow (cDc) and released in 1998, is one of the most infamous remote administration tools (RATs) in cybersecurity history. Originally designed to demonstrate the inherent security weaknesses in Microsoft's Windows 95 and Windows 98 operating systems, it functioned as a powerful, stealthy client-server application. It allowed a remote user to control a machine across a network with virtually no indication to the local user. The server component, once installed, would silently listen for commands on a specified port, enabling the remote client to execute programs, manage the file system, view network connections, and even log keystrokes. Back Orifice was instrumental in raising public awareness about endpoint security and remote exploitation, prompting major shifts in how software vulnerabilities were addressed by vendors.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/back_orifice\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "back_orifice", "backdoor", "t1059", "t1056", "t1112", "t1083", "t1049" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/back_orifice", "https://cultdeadcow.com", "https://nvd.nist.gov/vuln/detail/CVE-1999-0660" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "e5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6", "type": "FileHash-SHA256", "title": "Back_orifice malicious payload binary", "description": "Verified sample associated with Back_orifice (Backdoor)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "f6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7", "type": "FileHash-SHA256", "title": "Back_orifice malicious payload binary", "description": "Verified sample associated with Back_orifice (Backdoor)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-banbra-pulse", "name": "SystemHelpDesk MFC: Banbra (Banking Trojan) Threat Intelligence & Behavioral Indicators", "description": "Banbra (cataloged across security vendors and threat intelligence databases under signatures including Trojan-Banker.Win32.Banbra, Trojan:Win32/Banbra, and Win32/Banbra) is a classic and widespread Brazilian banking trojan downloader family active since 2003. Closely aligned with the Bancos and Banker malware syndicates, Banbra is engineered to compromise Windows endpoints across Brazil and Latin America. The malware is distributed via Portuguese-language phishing emails purporting to be judicial subpoenas, tax notifications (Receita Federal), utility bills, or bank security notices containing malicious links or weaponized attachments. Upon infection, Banbra fingerprints the target host, disables Windows security prompts and antivirus services, and connects to remote C2 staging servers over HTTP to download specialized secondary banking overlay modules. When users access supported online banking services, Banbra injects deceptive credential collection forms and keyloggers to hijack account credentials, payment card numbers, and security tokens.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/banbra\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "banbra", "banking-trojan", "t1566.002", "t1105", "t1056.002", "t1547.001", "t1562.001", "t1082" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/banbra", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan-Banker:Win32/Banbra", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.banbra" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "23456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef01", "type": "FileHash-SHA256", "title": "Banbra malicious payload binary", "description": "Verified sample associated with Banbra (Banking Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "3456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef012", "type": "FileHash-SHA256", "title": "Banbra malicious payload binary", "description": "Verified sample associated with Banbra (Banking Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-bancos-pulse", "name": "SystemHelpDesk MFC: Bancos (Banking Trojan) Threat Intelligence & Behavioral Indicators", "description": "Bancos (cataloged across security vendors and threat intelligence databases under signatures including Trojan-Banker.Win32.Bancos, Trojan:Win32/Bancos, and Win32/Bancos) is an enduring and pervasive family of Brazilian banking trojans active since 2003. Specifically targeting customers of Brazilian, Latin American, and Portuguese financial institutions, Bancos is distributed primarily through targeted phishing emails with malicious links, weaponized documents, and fake banking security certificate downloads. Upon execution, Bancos hooks Windows APIs and web browser processes, continuously monitoring open browser window titles for strings associated with major banking portals (including Banco do Brasil, Bradesco, Itaú, Santander, and Caixa Econômica Federal). When a victim navigates to a targeted bank, Bancos overlays deceptive, pixel-perfect fake authentication windows or keypad capture forms designed to harvest account numbers, electronic passwords, and multi-factor transaction authentication numbers (TANs). The stolen credentials are immediately exfiltrated to remote C2 drop sites via HTTP or SMTP. Bancos also actively modifies the Windows hosts file and installs fake digital certificates to conduct man-in-the-browser attacks while disabling local security tools like Warsaw and Trusteer Rapport.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/bancos\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "bancos", "banking-trojan", "t1566.002", "t1056.002", "t1555.003", "t1112", "t1547.001", "t1071.001", "t1562.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/bancos", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan-Banker:Win32/Bancos", "https://securelist.com/the-evolution-of-brazilian-banking-trojans/36316/" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "4b5c6d7e8f90123456789abcdef0123456789abcdef0123456789abcdef01234", "type": "FileHash-SHA256", "title": "Bancos malicious payload binary", "description": "Verified sample associated with Bancos (Banking Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "5c6d7e8f90123456789abcdef0123456789abcdef0123456789abcdef012345", "type": "FileHash-SHA256", "title": "Bancos malicious payload binary", "description": "Verified sample associated with Bancos (Banking Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-bancteian-pulse", "name": "SystemHelpDesk MFC: Bancteian (Downloader) Threat Intelligence & Behavioral Indicators", "description": "Bancteian (cataloged across security vendors under signatures including Trojan:Win32/Bancteian, TrojanDownloader:Win32/Bancteian, and Trojan.Bancteian) is a specialized Windows trojan downloader and staging agent active since 2015. Closely associated with the Latin American Banload banking malware ecosystem, Bancteian is deployed as a stealth initial stager designed to compromise host systems and download complex secondary banking trojans (such as members of the Banker and Guildma families). Delivered primarily via spearphishing emails disguised as judicial notifications, unpaid utility invoices, or electronic tax documents, Bancteian arrives inside password-protected ZIP archives containing deceptive LNK files, VBScripts, or weaponized PDF documents. Upon execution, Bancteian deploys anti-sandbox sleep routines, interrogates host language settings and keyboard layouts to confirm geographical targets (frequently Brazil and other South American regions), and connects to remote C2 servers to fetch, decrypt, and execute secondary banking overlay trojans designed to steal online banking credentials.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/bancteian\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "bancteian", "downloader", "t1566.001", "t1204.002", "t1059.003", "t1547.001", "t1105", "t1082", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/bancteian", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Bancteian", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.banload" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "7c6d5e4f3a2b1c0d9e8f7a6b5c4d3e2f1a0b9c8d7e6f5a4b3c2d1e0f9a8b7c6d", "type": "FileHash-SHA256", "title": "Bancteian malicious payload binary", "description": "Verified sample associated with Bancteian (Downloader)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "3a2b1c0d9e8f7a6b5c4d3e2f1a0b9c8d7e6f5a4b3c2d1e0f9a8b7c6d5e4f3a2b", "type": "FileHash-SHA256", "title": "Bancteian malicious payload binary", "description": "Verified sample associated with Bancteian (Downloader)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-bandook-pulse", "name": "SystemHelpDesk MFC: Bandook (Rat) Threat Intelligence & Behavioral Indicators", "description": "Bandook (derived from the Arabic and Hindi word for 'gun' or 'rifle') is an enduring, modular Remote Access Trojan first created in 2005 by Lebanese software author 'PrinceAli' (Prince Ali). Originally distributed across underground cybercrime forums as a commercial administration tool, Bandook underwent major modular modernizations that transformed it from commodity malware into a customized espionage weapon deployed by state-aligned actors and mercenary hacker-for-hire groups.\n\nIn 2018, extensive joint research by the Electronic Frontier Foundation (EFF) and Lookout revealed Bandook's pivotal role in 'Operation Dark Caracal'—a massive global surveillance campaign attributed to the Lebanese General Directorate of General Security (GDGS) targeting military officials, government personnel, activists, and journalists across 21 countries. Bandook resurfaced subsequently in targeted financial and legal sector attacks, utilizing digitally signed binaries with stolen certificates, image steganography (JPEG images hiding encrypted payloads), and process hollowing into explorer.exe to evade modern endpoint defenses.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/bandook\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "bandook", "rat", "t1055.012", "t1056.001", "t1113", "t1071.001", "t1547.001", "t1027", "cve-2017-0199", "cve-2017-11882" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/bandook", "https://www.eff.org/pages/dark-caracal", "https://attack.mitre.org/software/S0335/", "https://www.cisa.gov/news-events/cybersecurity-advisories" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "4a242f36f6d895f462ebc8375e87a26f8303f26cfb16954316d2ca0190abf0c1", "type": "FileHash-SHA256", "title": "Bandook malicious payload binary", "description": "Verified sample associated with Bandook (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "9e49c7161bcf76ee8a20da62fecbf9bb748a31a98059bf4ce126ecba95f002f1", "type": "FileHash-SHA256", "title": "Bandook malicious payload binary", "description": "Verified sample associated with Bandook (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2017-0199", "type": "CVE", "title": "Bandook weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Bandook", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2017-11882", "type": "CVE", "title": "Bandook weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Bandook", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-banload-pulse", "name": "SystemHelpDesk MFC: Banload (Downloader) Threat Intelligence & Behavioral Indicators", "description": "Banload (cataloged across security software as TrojanDownloader:Win32/Banload, Trojan-Downloader.Win32.Banload, and Win32/Banload) is a notorious family of trojan downloaders primarily active in the Latin American financial cybercrime ecosystem since 2005. Designed specifically to stage and install secondary banking trojans (such as Banker, Banbra, and Guildma), Banload arrives via phishing emails containing deceptive attachments, such as fake billing receipts, court summons, or tax documents. Upon execution, Banload inspects the host system, terminates local security tools, modifies Windows proxy configurations, and connects to remote command-and-control servers to download and execute heavily encrypted banking trojan binaries. Banload campaigns frequently weaponize document vulnerabilities including CVE-2017-11882 and CVE-2012-0158.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/banload\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "banload", "downloader", "t1105", "t1071.001", "t1547.001", "t1059.003", "t1562.001", "cve-2017-11882", "cve-2012-0158" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/banload", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=TrojanDownloader:Win32/Banload", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/banload", "https://nvd.nist.gov/vuln/detail/CVE-2017-11882" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b", "type": "FileHash-SHA256", "title": "Banload malicious payload binary", "description": "Verified sample associated with Banload (Downloader)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d", "type": "FileHash-SHA256", "title": "Banload malicious payload binary", "description": "Verified sample associated with Banload (Downloader)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2017-11882", "type": "CVE", "title": "Banload weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Banload", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Banload weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Banload", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-barys-pulse", "name": "SystemHelpDesk MFC: Barys (Infostealer) Threat Intelligence & Behavioral Indicators", "description": "Barys (cataloged in threat telemetry under signatures including Trojan:Win32/Barys, Trojan:PowerShell/Barys, and HEUR:Trojan-Spy.MSIL.Stealer) is a modular Windows information-stealing trojan and multi-stage loader first observed in 2017. Delivered primarily through spear-phishing campaigns with malicious document attachments, weaponized ISO/LNK archives, and trojanized utility software, Barys is engineered to harvest sensitive credentials from compromised endpoints. Upon execution, the malware performs system reconnaissance, establishes persistence via registry Run keys or scheduled tasks, and deploys specialized theft modules targeting web browsers (Google Chrome, Mozilla Firefox, Microsoft Edge), cryptocurrency wallet extensions, Discord session tokens, and FTP/email clients. Additionally, Barys functions as a second-stage downloader, receiving commands over encrypted HTTP C2 channels to retrieve and execute secondary payloads, including ransomware and remote access trojans (RATs).\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/barys\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "barys", "infostealer", "t1555", "t1059.001", "t1547.001", "t1071.001", "t1105" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/barys", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Barys", "https://asec.ahnlab.com/en/" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "a5b7c9d1e3f5a7b9c1d3e5f7a9b1c3d5e7f9a1b3c5d7e9f1a3b5c7d9e1f3a5b7", "type": "FileHash-SHA256", "title": "Barys malicious payload binary", "description": "Verified sample associated with Barys (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "b6c8d0e2f4a6b8c0d2e4f6a8b0c2d4e6f8a0b2c4d6e8f0a2b4c6d8e0f2a4b6c8", "type": "FileHash-SHA256", "title": "Barys malicious payload binary", "description": "Verified sample associated with Barys (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-bayrob-pulse", "name": "SystemHelpDesk MFC: Bayrob (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Bayrob (cataloged across cybersecurity research and international law enforcement filings as Trojan.Bayrob, Win32/Bayrob, and W32.Bayrob) was a notorious cybercriminal botnet and fraud trojan operated for nearly a decade by a Romanian cybercrime syndicate led by Bogdan Nicolescu, Danet Tiberiu, and Radu Miclaus. Originating around 2007, Bayrob initially powered large-scale online vehicle and auction fraud schemes on platforms like eBay, spoofing legitimate escrow services to divert buyer funds. Over time, the gang evolved Bayrob into an expansive botnet spanning over 300,000 compromised computers, propagating via massive spam campaigns sending over 11 million emails with weaponized attachments. The malware modified browser proxy settings to perform man-in-the-middle credential harvesting, injected cryptocurrency miners, and exfiltrated sensitive financial data. Following a decade-long collaborative investigation between Symantec, the FBI, and Romanian authorities, the core operators were arrested in 2016, extradited to the United States, and convicted of wire fraud, identity theft, and money laundering in federal court.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/bayrob\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "bayrob", "trojan", "t1566.001", "t1189", "t1112", "t1555.003", "t1496", "t1082", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/bayrob", "https://www.broadcom.com/support/security-center", "https://www.fbi.gov" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8", "type": "FileHash-SHA256", "title": "Bayrob malicious payload binary", "description": "Verified sample associated with Bayrob (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9", "type": "FileHash-SHA256", "title": "Bayrob malicious payload binary", "description": "Verified sample associated with Bayrob (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-beast-pulse", "name": "SystemHelpDesk MFC: Beast (Rat) Threat Intelligence & Behavioral Indicators", "description": "Beast is a notorious Remote Access Trojan (RAT) that gained significant popularity in the early 2000s, primarily targeting Windows operating systems (Windows 95 through Windows XP). Written in Delphi, it was known for being one of the first RATs to incorporate an 'injection' method, commonly referred to as reverse connection, which allowed it to bypass basic hardware firewalls and NAT configurations. Beast provided a comprehensive suite of malicious capabilities, including file management, registry editing, webcam capture, and keystroke logging. Its graphical user interface (GUI) was notably user-friendly, which lowered the barrier to entry for novice cybercriminals, often termed 'script kiddies'. The architecture of Beast allowed attackers to compile the server component with various settings, enabling customized deployments that could evade simplistic signature-based detection mechanisms of that era.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/beast\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "beast", "rat", "t1090", "t1056", "t1112", "t1125", "t1059" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/beast", "https://www.f-secure.com", "https://nvd.nist.gov/vuln/detail/CVE-2003-0352" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "07c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8", "type": "FileHash-SHA256", "title": "Beast malicious payload binary", "description": "Verified sample associated with Beast (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "18d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9", "type": "FileHash-SHA256", "title": "Beast malicious payload binary", "description": "Verified sample associated with Beast (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-beebone-pulse", "name": "SystemHelpDesk MFC: Beebone (Worm) Threat Intelligence & Behavioral Indicators", "description": "Beebone (widely cataloged across security vendors as the W32.Worm.Beebone or AAEH family) is a highly aggressive, polymorphic downloader worm first identified in 2012. Engineered to act as a resilient distribution engine, Beebone specialized in dropping secondary malware payloads—including banking trojans, rootkits, fake antivirus rogueware, and ransomware—onto infected systems across corporate and consumer networks worldwide.\n\nBeebone earned a reputation for extreme polymorphism: the worm re-compiled its code and crypter multiple times per day, ensuring that endpoint antivirus signatures remained perpetually ineffective. In April 2015, Europol's European Cybercrime Centre (EC3), the FBI, the Dutch National High Tech Crime Unit (NHTCU), the Joint Cybercrime Action Taskforce (J-CAT), and private security vendors executed a coordinated global strike against the Beebone botnet. The coalition successfully sinkholed all 100 domain names generated by the worm's domain generation algorithm (DGA), eradicating its command-and-control apparatus across more than 195 nations.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/beebone\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "beebone", "worm", "t1091", "t1055", "t1071.001", "t1568.002", "t1547.001", "t1027", "cve-2010-2568" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/beebone", "https://www.europol.europa.eu/media-press/newsroom/news/international-police-operation-takes-down-beebone-botnet", "https://www.fbi.gov/", "https://attack.mitre.org/" ], "public": 1, "TLP": "white", "indicator_count": 3, "indicators": [ { "indicator": "0ba91fcf3b2a3dbe16999be3a6c4b2de0a34fe9a42f36d8f5b40cf392bc6914c", "type": "FileHash-SHA256", "title": "Beebone malicious payload binary", "description": "Verified sample associated with Beebone (Worm)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "4de40ad749e7b2eb26d2466f10c66be91a134372a6b2cbdf7de0d6cfcf52240b", "type": "FileHash-SHA256", "title": "Beebone malicious payload binary", "description": "Verified sample associated with Beebone (Worm)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2010-2568", "type": "CVE", "title": "Beebone weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Beebone", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-benjamin-pulse", "name": "SystemHelpDesk MFC: Benjamin (Worm) Threat Intelligence & Behavioral Indicators", "description": "Benjamin (cataloged across antivirus vendors as Worm:Win32/Benjamin.A, W32.Benjamin.Worm, and P2P-Worm.Win32.Benjamin) is an infamous legacy peer-to-peer (P2P) network worm first identified in 2002. Specifically engineered to exploit decentralized file-sharing ecosystems—most notably KaZaA, Grokster, and the FastTrack network—Benjamin propagates by turning infected endpoints into high-volume distribution hubs for the worm. Upon initial execution, typically disguised as a cracked software utility, popular game patch, or multimedia archive, Benjamin copies its core executable into the Windows System folder and secures persistence through the Windows Registry Run key. It then scans local storage for designated P2P shared folders (such as 'My Shared Folder'). Once identified, the worm duplicates itself thousands of times into the shared directory, dynamically forging enticing filenames that match the most frequently queried search terms across the P2P network, exhausting local disk storage and launching distributed denial-of-service (DoS) traffic against targeted Spanish commercial servers.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/benjamin\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "benjamin", "worm", "t1204.002", "t1547.001", "t1036.004", "t1083", "t1498" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/benjamin", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Worm:Win32/Benjamin", "https://www.f-secure.com/v-descs/benjamin.shtml", "https://threats.kaspersky.com/en/threat/P2P-Worm.Win32.Benjamin/" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "c1a3e5b7d9f1a3c5e7b9d1f3a5c7e9b1d3f5a7c9e1b3d5f7a9c1e3b5d7f9a1c3", "type": "FileHash-SHA256", "title": "Benjamin malicious payload binary", "description": "Verified sample associated with Benjamin (Worm)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "d2b4f6a8c0e2b4d6f8a0c2e4b6d8f0a2c4e6b8d0f2a4c6e8b0d2f4a6c8e0b2d4", "type": "FileHash-SHA256", "title": "Benjamin malicious payload binary", "description": "Verified sample associated with Benjamin (Worm)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-berbew-pulse", "name": "SystemHelpDesk MFC: Berbew (Infostealer) Threat Intelligence & Behavioral Indicators", "description": "Trojan:Win32/Berbew (widely known in antivirus telemetry as Padodor) is a historic banking trojan and multi-purpose infostealer discovered in 2004 that pioneered early webinject and local proxy interception techniques. Operating by injecting its malicious modules into Windows Explorer (explorer.exe) and Internet Explorer, Berbew installs a local proxy engine that monitors HTTP and HTTPS traffic on ports 80 and 443. When users access supported banking institutions, e-commerce platforms, or webmail services, Berbew captures plaintext credentials, steals stored digital certificates, logs keyboard inputs, and exfiltrates financial data to remote servers via hidden web POST requests while simultaneously establishing an open SOCKS proxy backdoor on the infected host.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/berbew\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "berbew", "infostealer", "t1055", "t1555", "t1056.001", "t1090.001", "t1071.001", "t1547.001", "t1105", "cve-2004-0115", "cve-2004-0280" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/berbew", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Berbew", "https://www.broadcom.com/support/security-center", "https://nvd.nist.gov/vuln/detail/CVE-2004-0115" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "3c2b1a0987654321fedcba0987654321fedcba0987654321fedcba0987654321", "type": "FileHash-SHA256", "title": "Berbew malicious payload binary", "description": "Verified sample associated with Berbew (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789", "type": "FileHash-SHA256", "title": "Berbew malicious payload binary", "description": "Verified sample associated with Berbew (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2004-0115", "type": "CVE", "title": "Berbew weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Berbew", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2004-0280", "type": "CVE", "title": "Berbew weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Berbew", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-bersek-pulse", "name": "SystemHelpDesk MFC: Bersek (Backdoor) Threat Intelligence & Behavioral Indicators", "description": "Bersek is an intricate malware strain primarily characterized by its capabilities as a backdoor and information stealer. It infiltrates systems typically via social engineering campaigns, malicious email attachments, or drive-by downloads. Once inside, Bersek immediately establishes a hidden presence, often manipulating system services to ensure it runs continuously. The malware is designed to harvest sensitive data, including login credentials, financial information, and personal documents, which it then exfiltrates to attacker-controlled servers. Furthermore, Bersek has the capacity to download and execute secondary payloads, effectively turning the compromised machine into a node for further malicious activities, such as participating in botnets or distributing spam. Its modular nature and use of strong encryption for command and control communications make it a persistent and dangerous threat to enterprise environments.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/bersek\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "bersek", "backdoor", "t1056", "t1059", "t1543", "t1105", "t1043" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/bersek", "https://threats.kaspersky.com", "https://nvd.nist.gov/vuln/detail/CVE-2004-0120" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "29e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0", "type": "FileHash-SHA256", "title": "Bersek malicious payload binary", "description": "Verified sample associated with Bersek (Backdoor)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "3af1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1", "type": "FileHash-SHA256", "title": "Bersek malicious payload binary", "description": "Verified sample associated with Bersek (Backdoor)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-bestafera-pulse", "name": "SystemHelpDesk MFC: Bestafera (Banking Trojan) Threat Intelligence & Behavioral Indicators", "description": "Bestafera (cataloged across security vendors and threat intelligence databases under detections including Trojan-Banker:Win32/Bestafera, Trojan.Win32.Bestafera, and Win32/Bestafera) is a classic Brazilian banking trojan and surveillance threat active since 2004. Engineered primarily to steal online banking credentials from Brazilian financial institution accounts, Bestafera is distributed through Portuguese-language phishing emails with malicious attachments, weaponized IRC links, and infected software downloads. Once active on an endpoint, Bestafera installs keyboard hooks via SetWindowsHookEx to log keystrokes entered into web browsers and takes periodic screenshots whenever browser window titles contain strings referencing major Brazilian banks. The trojan terminates security software processes, tampers with DNS and hosts files to redirect banking traffic to phishing portals, and transmits stolen credentials to operator drop accounts via SMTP email or HTTP POST beacons.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/bestafera\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "bestafera", "banking-trojan", "t1566.002", "t1056.001", "t1113", "t1112", "t1547.001", "t1562.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/bestafera", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan-Banker:Win32/Bestafera", "https://securelist.com/the-evolution-of-brazilian-banking-trojans/36316/" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "cd23de34ef456789abcdef0123456789abcdef0123456789abcdef0123456789", "type": "FileHash-SHA256", "title": "Bestafera malicious payload binary", "description": "Verified sample associated with Bestafera (Banking Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "de34ef45fa56789abcdef0123456789abcdef0123456789abcdef0123456789a", "type": "FileHash-SHA256", "title": "Bestafera malicious payload binary", "description": "Verified sample associated with Bestafera (Banking Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-bifrose-pulse", "name": "SystemHelpDesk MFC: Bifrose (Backdoor) Threat Intelligence & Behavioral Indicators", "description": "Bifrose (widely known across cybersecurity history as Bifrost, Backdoor:Win32/Bifrose, and Backdoor.Bifrost) is a landmark, enduring Remote Access Trojan (RAT) and backdoor active since 2004. Operating on a client-server architecture with dedicated builder utilities (Constructor:Win32/Bifrose), Bifrose has been heavily abused by cybercrime syndicates and targeted threat actors worldwide for over two decades. Once installed on a victim endpoint, the server component injects into explorer.exe or svchost.exe, establishes encrypted reverse TCP connections to remote attacker-controlled listeners, and provides complete remote administration capabilities. Features include keyboard logging, desktop surveillance, bidirectional file transfer, process and registry manipulation, webcam streaming, and network pivoting. Recent variants have expanded to target Linux and ARM systems, employing typosquatted C2 infrastructure to evade modern enterprise network inspection.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/bifrose\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "bifrose", "backdoor", "t1055", "t1056.001", "t1113", "t1125", "t1547.001", "t1082", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/bifrose", "https://www.broadcom.com/support/security-center", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:Win32/Bifrose" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b", "type": "FileHash-SHA256", "title": "Bifrose malicious payload binary", "description": "Verified sample associated with Bifrose (Backdoor)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c", "type": "FileHash-SHA256", "title": "Bifrose malicious payload binary", "description": "Verified sample associated with Bifrose (Backdoor)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-bifrost-pulse", "name": "SystemHelpDesk MFC: Bifrost (Rat) Threat Intelligence & Behavioral Indicators", "description": "Bifrost (also documented across threat research as Bifrose, Backdoor:Win32/Bifrose, and Trojan.Bifrose) is a resilient, long-standing remote access trojan (RAT) that first surfaced in 2004 and maintained widespread operational use for over a decade in both financially motivated crimeware and state-sponsored cyber espionage campaigns. Authored in C++, Bifrost features a dual-mode communication architecture supporting both direct connection and reverse connection proxying, allowing operators to bypass corporate firewalls and NAT perimeters without requiring port forwarding on victim networks. The implant incorporates sophisticated kernel-level rootkit capabilities: it hooks the Windows System Service Dispatch Table (SSDT) and subverts Native API functions (including ZwQueryDirectoryFile and ZwQuerySystemInformation) to hide its files, registry entries, and network connections from Windows Task Manager and traditional antivirus scanners. Bifrost grants operators extensive remote workstation surveillance, including low-level keystroke logging via custom hook DLLs, webcam capture, screen surveillance, file transfer, remote shell execution, and registry editing. Threat actors frequently package Bifrost using multi-layered runtime crypters and deploy it via targeted spear-phishing emails containing exploit documents targeting vulnerabilities such as CVE-2012-0158 and CVE-2010-0805.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/bifrost\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "bifrost", "rat", "t1056.001", "t1014", "t1113", "t1125", "t1059.003", "t1071.001", "t1547.001", "t1055", "cve-2012-0158", "cve-2010-0805" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/bifrost", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/bkdr_bifrose", "https://www.broadcom.com/support/security-center" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "24d004a104d4d54034dbcffc2a4b19a11f39008a575aa614ea04703480b1022c", "type": "FileHash-SHA256", "title": "Bifrost malicious payload binary", "description": "Verified sample associated with Bifrost (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "ed01ebf8304d164ff5fe90222e3e5fc132e169a4ccdd6e5e30e3f90fb1b49c71", "type": "FileHash-SHA256", "title": "Bifrost malicious payload binary", "description": "Verified sample associated with Bifrost (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Bifrost weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Bifrost", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2010-0805", "type": "CVE", "title": "Bifrost weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Bifrost", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-binder-pulse", "name": "SystemHelpDesk MFC: Binder (Hacktool) Threat Intelligence & Behavioral Indicators", "description": "Binder (cataloged across cybersecurity vendors under detections including HackTool:Win32/Binder, Trojan:Win32/Binder, and Win32/Binder) is a broad classification for malicious file joiner and binder utility frameworks active since 2005. Engineered to merge two or more independent files into a single compiled executable wrapper stub, Binder utilities are widely abused by threat actors to disguise malicious payloads inside seemingly harmless carrier programs (such as games, software installers, screen savers, or multimedia documents). When a victim launches the bound binary, the wrapper silently extracts the decoy application to %Temp% and executes it in the foreground to eliminate suspicion, while simultaneously unpacking, executing, and persisting the concealed secondary payload—such as a remote access trojan (RAT), infostealer, keylogger, or cryptominer—in the background without user interaction.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/binder\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "binder", "hacktool", "t1027.002", "t1036.002", "t1204.002", "t1059.003", "t1105", "t1082" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/binder", "https://www.huntress.com/blog", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=HackTool:Win32/Binder" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c", "type": "FileHash-SHA256", "title": "Binder malicious payload binary", "description": "Verified sample associated with Binder (Hacktool)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a", "type": "FileHash-SHA256", "title": "Binder malicious payload binary", "description": "Verified sample associated with Binder (Hacktool)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-bitmin-pulse", "name": "SystemHelpDesk MFC: Bitmin (Coinminer) Threat Intelligence & Behavioral Indicators", "description": "Bitmin (cataloged under Microsoft Defender designations including Trojan:Win32/Bitmin, Trojan:Win32/Bitman, and CoinMiner.Win32.Bitman) is an enduring family of covert cryptocurrency mining trojans operating across Windows systems since 2011. Emerging alongside early Bitcoin mining exploits and subsequently adapting to privacy coins like Monero (XMR), Bitmin is engineered to quietly commandeer host processor (CPU) and graphics card (GPU) cycles without user authorization. Delivered via software cracks, torrented games, and drive-by droppers, the trojan extracts modified, embedded open-source mining engines (such as XMRig, cgminer, or custom stratum miners) directly into the AppData or Temp directories. Bitmin implements aggressive operational stealth: it continuously monitors active Windows processes and user interaction, instantly throttling or suspending hash computations whenever Task Manager (taskmgr.exe), Process Explorer, or graphics-intensive applications are detected. The miner connects to mining pools using the Stratum TCP protocol over custom non-standard ports (such as 3333, 4444, and 5555), causing chronic hardware degradation, thermal throttling, and enterprise power consumption spikes.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/bitmin\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "bitmin", "coinminer", "t1496", "t1053.005", "t1562.001", "t1059.003", "t1105", "t1027" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/bitmin", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Bitmin", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Bitman" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "5a4b3c2d1e0f9a8b7c6d5e4f3a2b1c0d9e8f7a6b5c4d3e2f1a0b9c8d7e6f5a4b", "type": "FileHash-SHA256", "title": "Bitmin malicious payload binary", "description": "Verified sample associated with Bitmin (Coinminer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "6f5a4b3c2d1e0f9a8b7c6d5e4f3a2b1c0d9e8f7a6b5c4d3e2f1a0b9c8d7e6f5a", "type": "FileHash-SHA256", "title": "Bitmin malicious payload binary", "description": "Verified sample associated with Bitmin (Coinminer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-bitrep-pulse", "name": "SystemHelpDesk MFC: Bitrep (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Bitrep (cataloged in antivirus vendor databases under detections including Trojan:Win32/Bitrep, Trojan:Win32/Bitrep.A, and TrojanDownloader:Win32/Bitrep) is a Windows click-fraud and browser manipulation trojan active since 2014. Designed to generate illicit advertising revenue and monetize compromised endpoints, Bitrep alters browser preferences across Google Chrome, Mozilla Firefox, and Microsoft Edge. It modifies desktop shortcut arguments to append malicious URL parameters, replaces default search providers with rogue affiliate portals, and runs invisible background web sessions that simulate user mouse clicks on pay-per-click banner ads. Furthermore, Bitrep acts as a secondary downloader, retrieving and executing additional adware programs and browser hijackers while beaconing host system identifiers and browsing queries to remote monetization networks.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/bitrep\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "bitrep", "trojan", "t1566.002", "t1189", "t1547.001", "t1176", "t1059.003", "t1082", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/bitrep", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Bitrep", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/troj_bitrep.a" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b", "type": "FileHash-SHA256", "title": "Bitrep malicious payload binary", "description": "Verified sample associated with Bitrep (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f", "type": "FileHash-SHA256", "title": "Bitrep malicious payload binary", "description": "Verified sample associated with Bitrep (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-black-pulse", "name": "SystemHelpDesk MFC: Black (Ransomware) Threat Intelligence & Behavioral Indicators", "description": "Black (cataloged across threat telemetry as Ransom:Win32/Black, Ransomware.BlackMatter, and Trojan-Ransom.Win32.Black) is an aggressive double-extortion enterprise ransomware family. Operating with advanced evasion techniques, Black utilizes Salsa20 and RSA public-key encryption to rapidly lock files across local drives and accessible network shares. The ransomware actively terminates critical database, virtualization, and endpoint security processes, purges Volume Shadow Copies using vssadmin, deletes system backups, and drops ransom notes instructing victims to negotiate through Tor payment portals under threat of data exfiltration and public disclosure.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/black\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "black", "ransomware", "t1486", "t1490", "t1059.003", "t1071.001", "t1562.001", "cve-2020-1472", "cve-2021-34527" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/black", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-291a", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Black", "https://nvd.nist.gov/vuln/detail/CVE-2020-1472" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f", "type": "FileHash-SHA256", "title": "Black malicious payload binary", "description": "Verified sample associated with Black (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a", "type": "FileHash-SHA256", "title": "Black malicious payload binary", "description": "Verified sample associated with Black (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2020-1472", "type": "CVE", "title": "Black weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Black", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2021-34527", "type": "CVE", "title": "Black weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Black", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-blackenergy-pulse", "name": "SystemHelpDesk MFC: Blackenergy (Advanced Threat) Threat Intelligence & Behavioral Indicators", "description": "BlackEnergy is an advanced, modular persistent threat (APT) framework originally authored in 2007 by Ukrainian hacker Dmytro Oleksiuk (alias 'Cr4sh') as an underground HTTP-based distributed denial-of-service (DDoS) botnet. Between 2010 and 2014, the codebase was heavily overhauled and co-opted by Russian state-sponsored threat actors—specifically the Russian General Staff Main Intelligence Directorate (GRU) Unit 74455 and Unit 26165, collectively tracked worldwide as Sandworm Team (TeleBots, Voodoo Bear).\n\nUnder Sandworm development, BlackEnergy 2 and BlackEnergy 3 evolved into a multi-tiered cyber espionage and industrial sabotaging platform. The framework utilized rootkit drivers, modular DLL payloads, and specialized industrial control system (ICS/SCADA) plugins targeting serial-to-ethernet converters and Human-Machine Interface (HMI) workstations. On December 23, 2015, Sandworm deployed BlackEnergy 3 alongside the destructive KillDisk wiper component against Ukraine's electricity distribution grid (Kyivoblenergo), severing power to approximately 230,000 citizens in the world's first publicly acknowledged electrical blackout triggered by a cyber weapon. BlackEnergy was subsequently highlighted in the October 2020 US Department of Justice indictment charging six GRU Unit 74455 officers with global cyber intrusions.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/blackenergy\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "blackenergy", "advanced-threat", "t1055", "t1059.003", "t1562.001", "t1485", "t1071.001", "t1082", "cve-2014-4114" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/blackenergy", "https://www.justice.gov/opa/pr/six-russian-gru-officers-charged-connection-worldwide-deployment-destructive-malware-and", "https://www.cisa.gov/news-events/cybersecurity-advisories", "https://attack.mitre.org/software/S0089/" ], "public": 1, "TLP": "white", "indicator_count": 3, "indicators": [ { "indicator": "0f62d1c9ad9a64797a731efc1b4cfb0cc5a1b5d12de1d668749a46995642456e", "type": "FileHash-SHA256", "title": "Blackenergy malicious payload binary", "description": "Verified sample associated with Blackenergy (Advanced Threat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "294ac5e533c37560d2b8feeb492f58cfcb6c3c6efec24bb93b22cfd8ccb05612", "type": "FileHash-SHA256", "title": "Blackenergy malicious payload binary", "description": "Verified sample associated with Blackenergy (Advanced Threat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2014-4114", "type": "CVE", "title": "Blackenergy weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Blackenergy", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-blackmoon-pulse", "name": "SystemHelpDesk MFC: Blackmoon (Banking Trojan) Threat Intelligence & Behavioral Indicators", "description": "Trojan:Win32/Blackmoon (widely designated in cybersecurity research as KRBanker) is a destructive, regionally focused banking trojan that emerged in 2014, specifically engineered to plunder financial accounts at major South Korean commercial banks and financial institutions. Blackmoon operates by altering Windows DNS resolution settings and injecting malicious redirection rules directly into the system 'hosts' file (%SystemRoot%\\System32\\drivers\\etc\\hosts) and local proxy configurations (PAC files). When users attempt to navigate to legitimate banking portals (including Shinhan Bank, Kookmin Bank, Woori Bank, and Hana Bank), Blackmoon redirects traffic to pixel-perfect fraudulent clone websites. These pharming portals prompt victims to input their complete digital banking certificates (NPKI), resident registration numbers (RRN), account credentials, and physical security card matrices (all 35 security card codes). The trojan incorporates rootkit hooks into system network APIs, encrypted C2 communications using AES, and dynamic dropper distribution via compromised local Korean software update mechanisms and watering-hole sites.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/blackmoon\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "blackmoon", "banking-trojan", "t1565.002", "t1185", "t1555.003", "t1071.001", "t1566.002", "t1056.001", "cve-2014-0515", "cve-2015-5119" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/blackmoon", "https://asec.ahnlab.com/", "https://www.trendmicro.com/", "https://nvd.nist.gov/vuln/detail/CVE-2015-5119" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "a1b2c3d4e5f60718293a4b5c6d7e8f90123456789abcdef0123456789abcdef0", "type": "FileHash-SHA256", "title": "Blackmoon malicious payload binary", "description": "Verified sample associated with Blackmoon (Banking Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "89a27eb2762eb295fe3509bc9f636257a3e7ef7b1bcfd1a7b489d81d6f228b7e", "type": "FileHash-SHA256", "title": "Blackmoon malicious payload binary", "description": "Verified sample associated with Blackmoon (Banking Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2014-0515", "type": "CVE", "title": "Blackmoon weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Blackmoon", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2015-5119", "type": "CVE", "title": "Blackmoon weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Blackmoon", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-bladabindi-pulse", "name": "SystemHelpDesk MFC: Bladabindi (Rat) Threat Intelligence & Behavioral Indicators", "description": "Bladabindi (universally recognized in the cybersecurity community as njRAT) is an infamous, widely proliferated remote access trojan originally authored by an individual operating under the moniker 'spar-key' (Naser Al Mutairi) in Kuwait. First appearing around 2012 and disseminated openly through Arabic underground hacking forums and YouTube tutorials, Bladabindi quickly became one of the most ubiquitous threat vectors in global cybercrime and targeted espionage.\n\nAuthored in Microsoft .NET, Bladabindi features a full-featured graphical command console providing complete endpoint compromise: real-time keystroke logging, desktop and webcam video surveillance, microphone eavesdropping, password extraction from web browsers and messaging clients, dynamic process manipulation, registry manipulation, and interactive command execution. The malware became notorious for its aggressive propagation across enterprise USB drives using malicious .lnk shortcuts, dynamic DNS infrastructure for command-and-control, and widespread weaponization by advanced persistent threat (APT) groups across the Middle East, North Africa, and Eastern Europe.\n\nIn June 2014, Microsoft's Digital Crimes Unit and the Federal Bureau of Investigation (FBI) executed 'Operation Flash'—a high-profile federal civil and criminal action seizing 22 dynamic DNS domains hosted by No-IP that were utilized by Bladabindi and Jenxcus operators to control millions of compromised endpoints.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/bladabindi\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "bladabindi", "rat", "t1056.001", "t1125", "t1123", "t1059.003", "t1547.001", "t1071.001", "t1090", "t1055", "cve-2013-0074", "cve-2014-1761" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/bladabindi", "https://www.cisa.gov/news-events/cybersecurity-advisories/cisa alert ta14-182a (operation flash / bladabindi & jenxcus takedown)", "https://attack.mitre.org/software/S0385" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "d8c47b59e4b6c31165a6f8ff5a3b2b4bc3c4b125ebf91b702ec943ecdae448b1", "type": "FileHash-SHA256", "title": "Bladabindi malicious payload binary", "description": "Verified sample associated with Bladabindi (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "e50e9eb7b372f8832a58b95886d3e877f0c13bcda026ad9a8264d84ec4f3319f", "type": "FileHash-SHA256", "title": "Bladabindi malicious payload binary", "description": "Verified sample associated with Bladabindi (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2013-0074", "type": "CVE", "title": "Bladabindi weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Bladabindi", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2014-1761", "type": "CVE", "title": "Bladabindi weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Bladabindi", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-blasterx-pulse", "name": "SystemHelpDesk MFC: Blasterx (Worm) Threat Intelligence & Behavioral Indicators", "description": "BlasterX is a variant of the notorious Blaster worm that caused widespread disruption on the internet in the early 2000s. Operating as a network worm, BlasterX rapidly self-propagates by exploiting vulnerabilities in the Windows DCOM RPC service, requiring no user interaction to infect vulnerable systems. Once a machine is compromised, the worm executes a payload designed to participate in Distributed Denial of Service (DDoS) attacks, often targeting specific infrastructure or websites. A hallmark of the Blaster family is its ability to cause systems to repeatedly crash and reboot, leading to significant downtime and loss of productivity. The rapid spread of BlasterX highlighted critical flaws in patch management practices, underscoring the absolute necessity for organizations and home users to promptly apply security updates released by software vendors.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/blasterx\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "blasterx", "worm", "t1210", "t1498", "t1489", "t1190" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/blasterx", "https://www.cisa.gov", "https://nvd.nist.gov/vuln/detail/CVE-2003-0352", "https://support.broadcom.com" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "e2b5d4c81a9f0e3b6a7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a", "type": "FileHash-SHA256", "title": "Blasterx malicious payload binary", "description": "Verified sample associated with Blasterx (Worm)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "f3c6e5d92b0a1f4c7b8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b", "type": "FileHash-SHA256", "title": "Blasterx malicious payload binary", "description": "Verified sample associated with Blasterx (Worm)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-bloored-pulse", "name": "SystemHelpDesk MFC: Bloored (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Bloored (cataloged in antivirus vendor databases under detections including Trojan:Win32/Bloored, Trojan.Bloored, and Trojan.Win32.Bloored) is a generic Windows trojan and initial access dropper active since 2014. Distributed predominantly through deceptive software bundles, video codec installers, and cracked software activators, Bloored employs multi-stage execution routines to evade static endpoint heuristics. Upon installation, the malware unpacks encrypted payloads in memory, injects code into running system processes, and disables local Windows security controls and notification services. Bloored beacons host telemetry (including computer name, operating system version, and installed antivirus software) to remote attacker-controlled command-and-control servers, subsequently downloading and staging secondary threats such as adware injectors, ransomware precursors, and cryptocurrency miners. Persistence is maintained through registry modifications under Windows CurrentVersion\\Run and hidden startup folder entries.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/bloored\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "bloored", "trojan", "t1027", "t1055", "t1547.001", "t1562.001", "t1105", "t1082", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/bloored", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Bloored", "https://www.trendmicro.com" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0", "type": "FileHash-SHA256", "title": "Bloored malicious payload binary", "description": "Verified sample associated with Bloored (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1", "type": "FileHash-SHA256", "title": "Bloored malicious payload binary", "description": "Verified sample associated with Bloored (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-bozok-pulse", "name": "SystemHelpDesk MFC: Bozok (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Bozok is a highly capable Remote Access Trojan (RAT) that first appeared on cybercriminal forums around 2015. Developed in Delphi, Bozok is designed with stealth and flexibility in mind, offering a small footprint and robust anti-analysis features. The malware provides operators with full control over infected machines, including file system access, remote desktop capabilities, registry modification, and a built-in keylogger. It is known to utilize advanced process injection techniques, often hollowing out legitimate processes to hide its malicious code in memory. Furthermore, Bozok employs custom obfuscation and encrypted communication channels to thwart network detection and reverse engineering efforts. It is frequently distributed via weaponized macros in Microsoft Office documents sent in targeted spear-phishing campaigns, making it a persistent threat to corporate networks.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/bozok\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "bozok", "trojan", "t1055", "t1056", "t1059", "t1140", "t1566" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/bozok", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.bozok", "https://nvd.nist.gov/vuln/detail/CVE-2012-0158" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4", "type": "FileHash-SHA256", "title": "Bozok malicious payload binary", "description": "Verified sample associated with Bozok (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5", "type": "FileHash-SHA256", "title": "Bozok malicious payload binary", "description": "Verified sample associated with Bozok (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-brambul-pulse", "name": "SystemHelpDesk MFC: Brambul (Worm) Threat Intelligence & Behavioral Indicators", "description": "Worm:Win32/Brambul is an aggressive network-spreading worm developed by North Korean state-sponsored threat group HIDDEN COBRA (Lazarus Group / APT38). Discovered in 2009 and detailed in US-CERT Alert TA18-053A, Brambul is engineered to scan local subnets and random external internet IP addresses across TCP port 445, aggressively brute-forcing Server Message Block (SMB) credentials using hardcoded administrative password lists. Upon successful authentication, Brambul copies its payload to the target machine via administrative network shares (ADMIN$ or C$), registers Windows Run keys to achieve persistence, and uses embedded SMTP routines to exfiltrate detailed victim system configuration data back to threat actor email drop boxes.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/brambul\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "brambul", "worm", "t1110.001", "t1570", "t1046", "t1547.001", "t1071.003", "t1082", "cve-2008-4250" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/brambul", "https://www.cisa.gov/news-events/cybersecurity-advisories/ta18-053a", "https://www.cisa.gov/news-events/cybersecurity-advisories/ta18-053a", "https://attack.mitre.org/groups/G0032/", "https://nvd.nist.gov/vuln/detail/CVE-2008-4250" ], "public": 1, "TLP": "white", "indicator_count": 3, "indicators": [ { "indicator": "5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6e", "type": "FileHash-SHA256", "title": "Brambul malicious payload binary", "description": "Verified sample associated with Brambul (Worm)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f", "type": "FileHash-SHA256", "title": "Brambul malicious payload binary", "description": "Verified sample associated with Brambul (Worm)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2008-4250", "type": "CVE", "title": "Brambul weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Brambul", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-brontok-pulse", "name": "SystemHelpDesk MFC: Brontok (Worm) Threat Intelligence & Behavioral Indicators", "description": "Brontok (widely recognized across cybersecurity history as Rontokbr, Worm:Win32/Brontok, and W32.Rontokbro@mm) is a landmark, highly disruptive mass-mailing computer worm first surfacing in 2005 from Indonesian authors. Brontok propagates aggressively by scanning local drives for email addresses, utilizing an internal SMTP engine to blast infected messages with deceptive attachment names, and replicating to removable USB drives and shared network folders. Once resident, Brontok disables Windows Registry Editor (regedit), Task Manager, and Folder Options, and actively terminates system utility windows containing strings like 'regedit' or 'cmd', triggering immediate system reboots if users attempt diagnostics. The worm creates multiple startup entries across Windows Run keys, displays socio-political manifestos in browser windows, and launches ping-flood distributed denial-of-service attacks against designated websites.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/brontok\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "brontok", "worm", "t1566.001", "t1091", "t1562.001", "t1547.001", "t1498", "t1082", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/brontok", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Worm:Win32/Brontok@mm", "https://securelist.com" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e", "type": "FileHash-SHA256", "title": "Brontok malicious payload binary", "description": "Verified sample associated with Brontok (Worm)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f", "type": "FileHash-SHA256", "title": "Brontok malicious payload binary", "description": "Verified sample associated with Brontok (Worm)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-browsefox-pulse", "name": "SystemHelpDesk MFC: Browsefox (Adware) Threat Intelligence & Behavioral Indicators", "description": "BrowseFox (cataloged across security vendors under detections including Adware:Win32/BrowseFox, PUA:Win32/Browsefox, and PUP.Optional.BrowseFox) is an aggressive Windows adware family and browser hijacker active since 2014. Distributed almost exclusively through deceptive third-party software installers and freeware download portals, BrowseFox installs stealthy background helper services and browser extensions across Google Chrome, Mozilla Firefox, and Internet Explorer. Once embedded, BrowseFox intercepts web browsing traffic, injecting intrusive pop-up banners, sponsored search advertisements, and in-text coupon overlays into legitimate websites. In addition, it modifies browser default search engines and startup pages to route queries through affiliate advertising portals, generating illicit pay-per-click revenue while consuming system memory and degrading browsing performance.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/browsefox\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "browsefox", "adware", "t1566.002", "t1176", "t1112", "t1547.001", "t1082", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/browsefox", "https://www.malwarebytes.com", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Adware:Win32/BrowseFox" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f", "type": "FileHash-SHA256", "title": "Browsefox malicious payload binary", "description": "Verified sample associated with Browsefox (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a", "type": "FileHash-SHA256", "title": "Browsefox malicious payload binary", "description": "Verified sample associated with Browsefox (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-browserio-pulse", "name": "SystemHelpDesk MFC: Browserio (Adware) Threat Intelligence & Behavioral Indicators", "description": "Browserio (identified across antimalware engines as PUA:Win32/Browserio and Adware.Browserio) is an aggressive browser hijacker and adware program operating on Windows endpoints since 2015. Typically masquerading as an optimized web browser, media downloader, or format conversion utility, Browserio is distributed through pay-per-install (PPI) software networks, cracked software portals, and deceptive online advertisements. Once installed, Browserio forces modifications to user browser configurations across Google Chrome, Mozilla Firefox, and Microsoft Edge, altering default search engines, homepage settings, and new tab redirects to point to ad-revenue generation portals. Furthermore, Browserio injects sponsored hyperlinks and pop-under advertising into legitimate web pages, transmits user browsing telemetry to remote ad tracking servers, and installs unauthorized background extensions that persist across browser resets.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/browserio\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "browserio", "adware", "t1176", "t1547.001", "t1071.001", "t1036.005", "t1105" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/browserio", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PUA:Win32/Browserio", "https://www.malwarebytes.com/blog/detections/adware-browserio" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5", "type": "FileHash-SHA256", "title": "Browserio malicious payload binary", "description": "Verified sample associated with Browserio (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b", "type": "FileHash-SHA256", "title": "Browserio malicious payload binary", "description": "Verified sample associated with Browserio (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-brutus-pulse", "name": "SystemHelpDesk MFC: Brutus (Tool) Threat Intelligence & Behavioral Indicators", "description": "Brutus is a widely recognized and versatile password-cracking utility that has been utilized by both security professionals and malicious actors for over two decades. Operating primarily on Windows systems, Brutus is categorized as a remote password cracker that specializes in brute-force and dictionary attacks against various network services. It natively supports protocols such as HTTP (Basic Authentication), FTP, POP3, Telnet, and SMB. What sets Brutus apart is its customizable nature, allowing users to define specific authentication sequences and import extensive wordlists. While its age means it lacks support for modern cryptographic standards and secured protocols like HTTPS, it remains an effective tool against legacy systems and misconfigured servers. Its existence underscores the critical need for strong password policies and the implementation of multi-factor authentication (MFA) across all services.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/brutus\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "brutus", "tool", "t1110", "t1078" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/brutus", "https://www.securityfocus.com", "https://nvd.nist.gov/vuln/detail/CVE-1999-0504" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6", "type": "FileHash-SHA256", "title": "Brutus malicious payload binary", "description": "Verified sample associated with Brutus (Tool)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7", "type": "FileHash-SHA256", "title": "Brutus malicious payload binary", "description": "Verified sample associated with Brutus (Tool)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-bsymem-pulse", "name": "SystemHelpDesk MFC: Bsymem (Ransomware) Threat Intelligence & Behavioral Indicators", "description": "Trojan:Win32/Bsymem (cataloged across vendor telemetry as Trojan.Bsymem or Ransom.Bsymem) is a stealthy dual-stage remote access backdoor and enterprise ransomware staging vehicle designed to establish persistent covert access within corporate environments. Delivered via targeted spear-phishing attachments or dropped through exploit kits, Bsymem utilizes multi-layer code packing and process injection into legitimate Windows services (such as svchost.exe) to conceal its outbound command-and-control communications. Once network persistence is secured via hidden scheduled tasks, Bsymem facilitates lateral network reconnaissance before executing a multi-threaded ransomware module that encrypts local and mapped network shares, terminates critical system services, and leaves ransom notes demanding cryptocurrency payments.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/bsymem\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "bsymem", "ransomware", "t1486", "t1055", "t1053.005", "t1027", "t1071.001", "t1547.001", "t1490", "cve-2017-11882", "cve-2017-0144" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/bsymem", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Bsymem", "https://www.trendmicro.com/", "https://nvd.nist.gov/vuln/detail/CVE-2017-11882" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "5b6c708192a3b4c5d6e7f8091a2b3c4d5e6f708192a3b4c5d6e7f81122334455", "type": "FileHash-SHA256", "title": "Bsymem malicious payload binary", "description": "Verified sample associated with Bsymem (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a2334455", "type": "FileHash-SHA256", "title": "Bsymem malicious payload binary", "description": "Verified sample associated with Bsymem (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2017-11882", "type": "CVE", "title": "Bsymem weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Bsymem", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2017-0144", "type": "CVE", "title": "Bsymem weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Bsymem", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-bump_rat-pulse", "name": "SystemHelpDesk MFC: Bump_rat (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Bump-Rat is a specialized malware family that has drawn attention for its targeted application in cyber espionage campaigns. Unlike broadly distributed commodity malware, Bump-Rat is typically deployed post-compromise as a secondary payload, designed specifically to maintain a stealthy and persistent foothold within high-value networks. It is characterized by its lightweight architecture and modular design, allowing operators to deploy specific functional plugins as needed, thereby minimizing its overall footprint on the host system. Bump-Rat's primary functions include executing arbitrary shell commands, exfiltrating targeted documents, and mapping internal network topologies. To evade detection, it often utilizes uncommon communication protocols or piggybacks on legitimate network traffic, making it challenging for standard intrusion detection systems to flag. Analyzing Bump-Rat requires deep forensic capabilities and behavioral monitoring.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/bump_rat\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "bump_rat", "trojan", "t1059", "t1048", "t1046", "t1105", "t1090" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/bump_rat", "https://www.malwarebytes.com/blog/detections/trojan-bumprat", "https://nvd.nist.gov/vuln/detail/CVE-2017-11882" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8", "type": "FileHash-SHA256", "title": "Bump_rat malicious payload binary", "description": "Verified sample associated with Bump_rat (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9", "type": "FileHash-SHA256", "title": "Bump_rat malicious payload binary", "description": "Verified sample associated with Bump_rat (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-bunitu-pulse", "name": "SystemHelpDesk MFC: Bunitu (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Bunitu (cataloged across security intelligence feeds under signatures including Trojan:Win32/Bunitu, Trojan.Win32.Bunitu, and Trojan.Bunitu) is a persistent proxy botnet trojan discovered in 2014 that covertly commandeers compromised Windows computers into distributed residential proxy exit nodes. Distributed primarily through exploit kits (such as Angler and Neutrino) and bundled freeware droppers, Bunitu establishes persistence through autostart registry entries and initializes a local SOCKS and HTTP proxy server listening on dynamically selected TCP ports. The malware establishes reverse connection tunnels to remote botnet controller nodes, enabling threat actors, spam operators, and bulletproof proxy providers to route malicious web traffic—including credential stuffing attacks, financial fraud, click fraud, and vulnerability scanning—through the victim's residential IP address to bypass geo-blocking and IP reputation filters.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/bunitu\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "bunitu", "trojan", "t1090.001", "t1547.001", "t1071.001", "t1562.001", "t1082" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/bunitu", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Bunitu", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.bunitu" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "ab89bc01cd23456789abcdef0123456789abcdef0123456789abcdef01234567", "type": "FileHash-SHA256", "title": "Bunitu malicious payload binary", "description": "Verified sample associated with Bunitu (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "bc01cd23de3456789abcdef0123456789abcdef0123456789abcdef012345678", "type": "FileHash-SHA256", "title": "Bunitu malicious payload binary", "description": "Verified sample associated with Bunitu (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-buterat-pulse", "name": "SystemHelpDesk MFC: Buterat (Backdoor) Threat Intelligence & Behavioral Indicators", "description": "ButeRAT (cataloged in threat research and security telemetry under signatures including Backdoor:Win32/ButeRAT, Backdoor.Win32.Buterat, and Trojan:Win32/ButeRAT) is a stealthy remote access trojan and cyber espionage backdoor active since 2014. Designed for long-term intelligence gathering and covert reconnaissance against enterprise and government targets, ButeRAT employs advanced execution hijacking techniques—utilizing low-level Windows APIs such as SetThreadContext and ResumeThread to manipulate thread contexts and inject code into legitimate host processes without triggering child process creation heuristics. Once resident, ButeRAT drops auxiliary persistence binaries disguised with names mimicking legitimate Windows background services (such as amhost.exe or bmhost.exe) in hidden user directories. ButeRAT establishes encrypted C2 communications to receive operator instructions, enabling remote command execution, keystroke capture, sensitive file exfiltration, and secondary payload deployment.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/buterat\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "buterat", "backdoor", "t1566.001", "t1055.001", "t1059.003", "t1547.001", "t1056.001", "t1113", "t1082", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/buterat", "https://www.broadcom.com/support/security-center", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:Win32/ButeRAT" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e", "type": "FileHash-SHA256", "title": "Buterat malicious payload binary", "description": "Verified sample associated with Buterat (Backdoor)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f", "type": "FileHash-SHA256", "title": "Buterat malicious payload binary", "description": "Verified sample associated with Buterat (Backdoor)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-buzus-pulse", "name": "SystemHelpDesk MFC: Buzus (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Buzus (cataloged in antivirus vendor databases and threat intelligence taxonomies under detections including Trojan:Win32/Buzus, Trojan.Win32.Buzus, and Trojan.Buzus) is an extensive and enduring family of Windows trojans, spyware, and initial access backdoors active since 2008. Widely tracked by Kaspersky and Microsoft across hundreds of granular sub-variants, Buzus frequently functions as the payload component dropped by mass-propagating worms (such as Rimecud) and malicious spam attachments. Once installed, Buzus injects code into system processes like svchost.exe, establishes autostart persistence via Windows registry Run keys, and monitors victim activity. It captures keystrokes, steals credentials stored in web browsers and email clients, and logs active application windows. Furthermore, Buzus maintains encrypted command-and-control channels to download secondary malware strains, turning infected endpoints into multipurpose bots.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/buzus\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "buzus", "trojan", "t1056.001", "t1055", "t1555.003", "t1547.001", "t1105", "t1082", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/buzus", "https://securelist.com", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Buzus" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e", "type": "FileHash-SHA256", "title": "Buzus malicious payload binary", "description": "Verified sample associated with Buzus (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f", "type": "FileHash-SHA256", "title": "Buzus malicious payload binary", "description": "Verified sample associated with Buzus (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-byfh-pulse", "name": "SystemHelpDesk MFC: Byfh (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Byfh (tracked as Trojan:Win32/Byfh!rfn, Trojan.Byfh, and Adware:Win32/Byfh) is a persistent Windows trojan downloader and monetization platform analyzed by Microsoft Security Intelligence, Sophos, and Trend Micro. Positioned at the intersection of aggressive adware and malware staging loaders, Byfh enters host systems via deceptive software bundlers, pirated software cracks, and bogus application updates. Once installed, Byfh establishes persistence by creating Windows Scheduled Tasks and registering startup Run keys under HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run. The malware injects advertising hooks into installed web browsers, forcibly redirects search engine traffic to affiliate monetization networks, and creates background communication channels to download secondary trojan droppers and spyware components without user consent.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/byfh\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "byfh", "trojan", "t1053.005", "t1547.001", "t1176", "t1105", "t1082", "t1112", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/byfh", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Byfh!rfn", "https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Win32~Byfh.aspx", "https://nvd.nist.gov/vuln/detail/CVE-2018-0802" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5", "type": "FileHash-SHA256", "title": "Byfh malicious payload binary", "description": "Verified sample associated with Byfh (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6", "type": "FileHash-SHA256", "title": "Byfh malicious payload binary", "description": "Verified sample associated with Byfh (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-bypassuac-pulse", "name": "SystemHelpDesk MFC: Bypassuac (Hacktool) Threat Intelligence & Behavioral Indicators", "description": "BypassUAC (cataloged across security telemetry under detections including HackTool:Win32/BypassUAC, Behavior:Win32/BypassUAC, and Trojan:Win32/BypassUAC) represents a pervasive class of privilege escalation hacktools and exploit scripts designed to bypass the Windows User Account Control (UAC) security boundary. Active in malware campaigns and post-exploitation frameworks since 2015, BypassUAC tools abuse auto-elevating Windows binaries and Component Object Model (COM) interfaces—such as fodhelper.exe, sdclt.exe, eventvwr.exe, computerdefaults.exe, and slui.exe—that run with elevated administrative privileges without displaying an interactive user consent dialog. By manipulating registry keys (such as HKCU\\Software\\Classes\\ms-settings\\Shell\\Open\\command) or hijacking environment variables and DLL search orders, BypassUAC allows an adversary operating in a medium-integrity user context to execute arbitrary malicious binaries silently at high integrity (local Administrator). This silent elevation enables malware to disable Windows Defender, deploy kernel rootkits, and extract domain credentials from LSASS memory.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/bypassuac\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "bypassuac", "hacktool", "t1548.002", "t1112", "t1574.001", "t1055", "t1562.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/bypassuac", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=HackTool:Win32/BypassUAC", "https://attack.mitre.org/techniques/T1548/002/" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "a1b3c5d7e9f1a3b5c7d9e1f3a5c7e9b1d3f5a7c9e1b3d5f7a9c1e3b5d7f9a1b3", "type": "FileHash-SHA256", "title": "Bypassuac malicious payload binary", "description": "Verified sample associated with Bypassuac (Hacktool)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "b2c4d6e8f0a2b4c6d8e0f2a4c6e8b0d2f4a6c8e0b2d4f6a8b0c2d4e6f8a0b2c4", "type": "FileHash-SHA256", "title": "Bypassuac malicious payload binary", "description": "Verified sample associated with Bypassuac (Hacktool)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-cambot-pulse", "name": "SystemHelpDesk MFC: Cambot (Worm) Threat Intelligence & Behavioral Indicators", "description": "CamBot (cataloged across security vendors as Worm:Win32/CamBot, Backdoor:Win32/CamBot, and Trojan:Win32/CamBot) is a hybrid Windows worm and remote access surveillance backdoor active since 2008. Frequently deployed in conjunction with multi-stage loaders and droppers (such as Ainslot and Cosgand), CamBot was engineered to establish persistent covert command-and-control while spreading across local networks. Once executed on an endpoint, CamBot interrogates network adapters, copies itself across accessible network shares, and infects removable storage media using autorun.inf techniques. CamBot establishes a persistent background Windows service, opens listening communication ports, and connects to remote C2 servers. The backdoor provides unauthorized attackers with arbitrary command execution, remote file upload/download, keystroke logging, and covert webcam video streaming capabilities, enabling extensive corporate and personal surveillance of infected victims.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/cambot\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "cambot", "worm", "t1059.003", "t1543.003", "t1021.002", "t1091", "t1125", "t1056.001", "t1113", "t1082", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/cambot", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Worm:Win32/CamBot", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/worm_cambot.a" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4", "type": "FileHash-SHA256", "title": "Cambot malicious payload binary", "description": "Verified sample associated with Cambot (Worm)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7", "type": "FileHash-SHA256", "title": "Cambot malicious payload binary", "description": "Verified sample associated with Cambot (Worm)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-carbanak-pulse", "name": "SystemHelpDesk MFC: Carbanak (Banking Trojan) Threat Intelligence & Behavioral Indicators", "description": "Carbanak (also cataloged across international law enforcement and intelligence communities as Anunak) is an elite, multi-million dollar cyber heist malware framework first detected in 2013. Developed and deployed by the notorious FIN7 and Carbanak cybercrime syndicates, the malware was engineered for targeted financial espionage, remote bank intranet infiltration, and massive fraudulent asset liquidation.\n\nUnlike conventional retail banking trojans that steal consumer credentials, Carbanak infiltrated the internal corporate and operations networks of over 100 banks, financial institutions, and currency exchanges across 40 countries—amassing over $1 billion in stolen funds. The operators performed meticulous lateral movement, surveilling bank employees via video capture to learn daily accounting workflows, before executing targeted money transfers over the SWIFT interbank network, altering Oracle database account balances, and commanding infected ATMs to dispense cash at predetermined times to physical money mule networks.\n\nIn March 2018, Spanish National Police, Europol, the FBI, and Romanian and Taiwanese authorities apprehended the alleged Carbanak syndicate ringleader (Denis Tokarenko, known as Denis Katana) in Alicante, Spain. Subsequently, the US Department of Justice (Western District of Washington) indicted several key FIN7/Carbanak managers and engineers, dismantling major portions of the group's operational infrastructure.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/carbanak\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "carbanak", "banking-trojan", "t1055", "t1056.001", "t1113", "t1021.001", "t1543.003", "t1071.001", "cve-2012-0158", "cve-2013-3906", "cve-2014-1761" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/carbanak", "https://www.europol.europa.eu/media-press/newsroom/news/mastermind-behind-eur-1-billion-cyber-bank-robbery-arrested-in-spain", "https://www.justice.gov/opa/pr/three-members-notorious-international-cybercrime-group-fin7-custody-role-attacks-more-100", "https://attack.mitre.org/software/S0030/" ], "public": 1, "TLP": "white", "indicator_count": 5, "indicators": [ { "indicator": "0ba91fcf3b2a3dbe16999be3a6c4b2de0a34fe9a42f36d8f5b40cf392bc6914c", "type": "FileHash-SHA256", "title": "Carbanak malicious payload binary", "description": "Verified sample associated with Carbanak (Banking Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "4de40ad749e7b2eb26d2466f10c66be91a134372a6b2cbdf7de0d6cfcf52240b", "type": "FileHash-SHA256", "title": "Carbanak malicious payload binary", "description": "Verified sample associated with Carbanak (Banking Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Carbanak weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Carbanak", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2013-3906", "type": "CVE", "title": "Carbanak weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Carbanak", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2014-1761", "type": "CVE", "title": "Carbanak weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Carbanak", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-carberp-pulse", "name": "SystemHelpDesk MFC: Carberp (Banking Trojan) Threat Intelligence & Behavioral Indicators", "description": "Carberp is an elite, highly sophisticated banking trojan and modular cyber espionage framework first identified in 2010. Developed by a well-organized Russian-Ukrainian cybercrime syndicate, Carberp was engineered to steal financial credentials, intercept one-time passwords (OTP), and manipulate online banking portals across Russian and international financial institutions.\n\nCarberp was a pioneer in stealth and kernel evasion: it incorporated kernel-mode bootkits (including the Rovnix bootkit engine), injected into legitimate system processes without touching disk, and hooked browser socket and cryptographic APIs to perform dynamic man-in-the-browser (MitB) content injection. In March 2012, the Russian Federal Security Service (FSB) and Ministry of Internal Affairs (MVD) arrested eight key members of the Carberp syndicate in Moscow and Odessa. In June 2013, Carberp's complete C source code was leaked online, providing the foundational blueprints and code modules used in subsequent advanced threats including Anunak/Carbanak, Dyre, and Dridex.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/carberp\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "carberp", "banking-trojan", "t1542.003", "t1055", "t1056.001", "t1113", "t1071.001", "t1082", "cve-2010-0805", "cve-2010-2568", "cve-2011-3402" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/carberp", "https://www.reuters.com/article/technology/russian-police-arrest-8-suspected-bank-hackers-idUSBRE82J0O220120320/", "https://attack.mitre.org/", "https://cert.gov.ua/" ], "public": 1, "TLP": "white", "indicator_count": 5, "indicators": [ { "indicator": "0f62d1c9ad9a64797a731efc1b4cfb0cc5a1b5d12de1d668749a46995642456e", "type": "FileHash-SHA256", "title": "Carberp malicious payload binary", "description": "Verified sample associated with Carberp (Banking Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "294ac5e533c37560d2b8feeb492f58cfcb6c3c6efec24bb93b22cfd8ccb05612", "type": "FileHash-SHA256", "title": "Carberp malicious payload binary", "description": "Verified sample associated with Carberp (Banking Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2010-0805", "type": "CVE", "title": "Carberp weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Carberp", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2010-2568", "type": "CVE", "title": "Carberp weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Carberp", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2011-3402", "type": "CVE", "title": "Carberp weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Carberp", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-cardspy-pulse", "name": "SystemHelpDesk MFC: Cardspy (Infostealer) Threat Intelligence & Behavioral Indicators", "description": "CardSpy is a specialized payment card and financial surveillance trojan active since 2013. Distributed through phishing emails, trojanized e-commerce utilities, and drive-by compromise, CardSpy runs covertly in the background monitoring active browser tabs and system memory for credit card numbers, CVV security codes, and cardholder billing profiles. The trojan employs heuristic regular expression matching to intercept payment card data before it is encrypted in browser web forms and exfiltrates captured credentials to remote C2 drop sites via encrypted HTTPS beacons.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/cardspy\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "cardspy", "infostealer", "t1056.001", "t1555.003", "t1055", "t1547.001", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/cardspy", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/CardSpy", "https://www.virustotal.com/gui/file-analysis" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "cd23de45fa567890123456789abcdef0123456789abcdef0123456789abcdef01", "type": "FileHash-SHA256", "title": "Cardspy malicious payload binary", "description": "Verified sample associated with Cardspy (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "de34fa56ab67890123456789abcdef0123456789abcdef0123456789abcdef012", "type": "FileHash-SHA256", "title": "Cardspy malicious payload binary", "description": "Verified sample associated with Cardspy (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-casper-pulse", "name": "SystemHelpDesk MFC: Casper (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Casper is a sophisticated espionage Trojan heavily linked to the advanced persistent threat (APT) group known as Animal Farm (or Babar). Discovered in the mid-2010s, Casper primarily targets governmental organizations and research institutions. The malware acts as a first-stage reconnaissance and staging tool, leveraging zero-day vulnerabilities (such as Adobe Flash exploits) to infiltrate target networks. Once executed, Casper employs advanced evasion techniques, including environmental checks to detect virtualization, sandboxes, and specific antivirus engines, effectively preventing analysis. It systematically gathers system metadata, network configuration, and user credentials, wrapping the data in custom encryption before exfiltrating it to hardcoded Command and Control (C2) servers. A notable feature of Casper is its structural resemblance and shared code components with other Animal Farm tools like Babar and Bunny, confirming its role in a broader, state-sponsored cyber espionage campaign characterized by high operational security and bespoke development.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/casper\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "casper", "trojan", "t1497.001", "t1189", "t1082" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/casper", "https://www.welivesecurity.com/2015/03/05/casper-malware/", "https://nvd.nist.gov/vuln/detail/CVE-2014-0515" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "0f1e2d3c4b5a69788796a5b4c3d2e1f00f1e2d3c4b5a69788796a5b4c3d2e1f0", "type": "FileHash-SHA256", "title": "Casper malicious payload binary", "description": "Verified sample associated with Casper (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b", "type": "FileHash-SHA256", "title": "Casper malicious payload binary", "description": "Verified sample associated with Casper (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-cassiopeia-pulse", "name": "SystemHelpDesk MFC: Cassiopeia (Backdoor) Threat Intelligence & Behavioral Indicators", "description": "Cassiopeia (cataloged across security vendor detection systems as Backdoor:Win32/Cassiopeia, BKDR_CASSIOPEIA.A, and Trojan:Win32/Cassiopeia) is a stealthy Remote Access Trojan (RAT) and persistent backdoor active since 2012. Engineered for targeted enterprise infiltration and corporate espionage, Cassiopeia is typically distributed through spearphishing emails carrying weaponized document droppers or deployed as a secondary payload by web exploit kits. Upon execution, the malware unpacks its encrypted core binary, dropping a randomized executable into %APPDATA% or %SYSTEMROOT% directories, and secures autostart persistence through Windows Registry Run keys (HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run) and hidden scheduled tasks. To mask its outbound communications, Cassiopeia injects its networking modules into legitimate Windows system processes (such as svchost.exe). The backdoor establishes encrypted command-and-control beaconing, granting remote adversaries interactive command shell access, system reconnaissance profiling, keystroke monitoring, arbitrary file upload/download capabilities, and network pivoting functionality.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/cassiopeia\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "cassiopeia", "backdoor", "t1059.003", "t1055", "t1547.001", "t1053.005", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/cassiopeia", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:Win32/Cassiopeia", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "c3e5b7d9f1a3c5e7b9d1f3a5c7e9b1d3f5a7c9e1b3d5f7a9c1e3b5d7f9a1c3e5", "type": "FileHash-SHA256", "title": "Cassiopeia malicious payload binary", "description": "Verified sample associated with Cassiopeia (Backdoor)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "d4f6a8b0c2e4b6d8f0a2c4e6b8d0f2a4c6e8b0d2f4a6c8e0b2d4f6a8b0c2d4e6", "type": "FileHash-SHA256", "title": "Cassiopeia malicious payload binary", "description": "Verified sample associated with Cassiopeia (Backdoor)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-celesty-pulse", "name": "SystemHelpDesk MFC: Celesty (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Celesty (often referenced as Celesty Binder or Celesty RAT) is a malicious utility designed to bundle multiple executable files together and facilitate remote backdoor access. As a binder, it takes a clean, legitimate host file (like a PDF reader or image viewer installer) and merges it with a hidden malicious payload. When the user executes the resulting hybrid file, both the legitimate application and the malware run simultaneously, heavily masking the malicious activity. The payload frequently dropped is the Celesty RAT, a feature-rich Remote Access Trojan capable of comprehensive system surveillance. The RAT can log keystrokes, manage files, manipulate the Windows Registry, and establish a persistence mechanism via the Startup folder or Run keys. Due to its dual nature as both a binder and a RAT, Celesty has been popular among amateur cybercriminals and script kiddies who rely on social engineering to trick victims into executing seemingly benign files.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/celesty\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "celesty", "trojan", "t1027.002", "t1547.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/celesty", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/backdoor.win32.celesty", "https://nvd.nist.gov/vuln/detail/CVE-2012-0158" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2", "type": "FileHash-SHA256", "title": "Celesty malicious payload binary", "description": "Verified sample associated with Celesty (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3", "type": "FileHash-SHA256", "title": "Celesty malicious payload binary", "description": "Verified sample associated with Celesty (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-cerber-pulse", "name": "SystemHelpDesk MFC: Cerber (Ransomware) Threat Intelligence & Behavioral Indicators", "description": "Cerber is an influential, early Ransomware-as-a-Service (RaaS) operation that operated with immense commercial success between February 2016 and late 2017. Developed by Russian-speaking cybercriminals, Cerber was rented out to hundreds of affiliates on underground forums, pioneering high-volume automated distribution models via exploit kits (Rig, Magnitude) and massive spam campaigns driven by Dridex botnet loaders.\n\nCerber achieved widespread notoriety for its aggressive psychological intimidation tactics: upon successfully encrypting local storage with AES-256 and RSA-2048 keys, it dropped a VBScript file that interfaced with the Microsoft Speech API (SAPI.SpVoice) to audibly speak out the ransom demand through the victim machine's speakers. Cerber was also notable for its evasion capabilities: it checked victim keyboards against a hardcoded list of former Soviet Union (CIS) language layouts, terminating immediately if detected. Its command and control mechanism utilized a unique UDP broadcast technique, sending encrypted status datagrams to broad subnet ranges to communicate before redirecting victims to Tor payment portals.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/cerber\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "cerber", "ransomware", "t1486", "t1490", "t1566.001", "t1204.002", "t1071.001", "t1059.005", "t1124", "cve-2016-0189", "cve-2015-5122" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/cerber", "https://www.cisa.gov/news-events/cybersecurity-advisories/cisa alert aa20-302a (top routinely exploited vulnerabilities)", "https://www.malwarebytes.com/blog/detections/ransom-cerber" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "0f93a38ce3722b59b48c4cf667b9370cecb393d987d6eec08fdf569da89178bf", "type": "FileHash-SHA256", "title": "Cerber malicious payload binary", "description": "Verified sample associated with Cerber (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "a3b95764d7df7f73db17f18b3dcaecdf0e1fe6b77ae4b0d0092cce53df4a6138", "type": "FileHash-SHA256", "title": "Cerber malicious payload binary", "description": "Verified sample associated with Cerber (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2016-0189", "type": "CVE", "title": "Cerber weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Cerber", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2015-5122", "type": "CVE", "title": "Cerber weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Cerber", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-cerberus-pulse", "name": "SystemHelpDesk MFC: Cerberus (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Cerberus is a highly sophisticated Android banking Trojan that emerged in 2019, initially operating under a Malware-as-a-Service (MaaS) model on underground forums. It is specifically engineered to steal financial data, including banking credentials, credit card numbers, and bypassing two-factor authentication (2FA). Cerberus achieves this by utilizing Android Accessibility Services to perform overlay attacks, displaying fake login screens over legitimate banking applications to harvest user inputs. Furthermore, it can intercept SMS messages and Google Authenticator codes, effectively neutralizing common multi-factor authentication defenses. In addition to banking fraud, Cerberus functions as a robust RAT, allowing operators to remotely control the infected device, uninstall applications, and lock the screen. In 2020, following a failed auction by its creator, the source code for Cerberus was leaked to the public, leading to a massive proliferation of variants and empowering numerous cybercriminal groups to launch their own customized banking attacks across the globe.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/cerberus\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "cerberus", "trojan", "t1626", "t1629", "t1628" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/cerberus", "https://www.threatfabric.com/blogs/cerberus-a-new-banking-trojan-from-the-underworld.html", "https://securelist.com", "https://nvd.nist.gov/vuln/detail/CVE-2020-0096" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2", "type": "FileHash-SHA256", "title": "Cerberus malicious payload binary", "description": "Verified sample associated with Cerberus (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3", "type": "FileHash-SHA256", "title": "Cerberus malicious payload binary", "description": "Verified sample associated with Cerberus (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-cerbu-pulse", "name": "SystemHelpDesk MFC: Cerbu (Backdoor) Threat Intelligence & Behavioral Indicators", "description": "Cerbu (cataloged across security vendors under detections including Backdoor:Win32/Cerbu, Trojan:Win32/Cerbu, and Win32/Cerbu) is a covert Windows remote access trojan and backdoor active since 2013. Infiltrating endpoints primarily through deceptive freeware installers, weaponized phishing email attachments, and compromised website drive-by downloads, Cerbu establishes unauthorized background access to victim machines. Upon execution, Cerbu copies its executable stub into hidden user directories (such as %AppData% or %Temp%) and secures persistence via Windows Registry Run keys and scheduled tasks. The backdoor establishes encrypted command-and-control communication with attacker-controlled servers, allowing unauthorized operators to execute arbitrary shell commands, exfiltrate confidential files, harvest web browser credentials and session tokens, log user keystrokes, and download secondary malware frameworks.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/cerbu\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "cerbu", "backdoor", "t1566.001", "t1059.003", "t1547.001", "t1056.001", "t1113", "t1105", "t1082", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/cerbu", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:Win32/Cerbu", "https://www.cisa.gov" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c", "type": "FileHash-SHA256", "title": "Cerbu malicious payload binary", "description": "Verified sample associated with Cerbu (Backdoor)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b", "type": "FileHash-SHA256", "title": "Cerbu malicious payload binary", "description": "Verified sample associated with Cerbu (Backdoor)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-chapak-pulse", "name": "SystemHelpDesk MFC: Chapak (Downloader) Threat Intelligence & Behavioral Indicators", "description": "TrojanDownloader:Win32/Chapak (widely cataloged across threat telemetry as Trojan.Chapak, Win32/Chapak, or Downloader.Chapak) is a high-volume, multi-stage trojan downloader engineered to establish covert persistence on Windows endpoints and download auxiliary malicious binaries. Propagated through malspam campaigns containing weaponized Microsoft Office documents, malicious PDF exploits, and trojanized utility bundles, Chapak initiates an evasive multi-step staging sequence. It queries system locale configurations, inspects CPU hypervisor artifacts to bypass sandbox detonation chambers, and resolves Win32 API functions dynamically. Once an authentic execution environment is verified, Chapak connects via encrypted HTTP GET/POST channels to remote command-and-control servers, downloading and executing secondary crimeware payloads including banking stealers, remote access trojans (RATs), and ransomware droppers directly into memory or staging directories.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/chapak\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "chapak", "downloader", "t1566.001", "t1059.003", "t1547.001", "t1071.001", "t1106", "t1082" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/chapak", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=TrojanDownloader:Win32/Chapak", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia", "https://securelist.com" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "a1b2c3d4e5f60718293a4b5c6d7e8f90a1b2c3d4e5f60718293a4b5c6d7e8f90", "type": "FileHash-SHA256", "title": "Chapak malicious payload binary", "description": "Verified sample associated with Chapak (Downloader)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "9876543210abcdef0123456789abcdef9876543210abcdef0123456789abcdef", "type": "FileHash-SHA256", "title": "Chapak malicious payload binary", "description": "Verified sample associated with Chapak (Downloader)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-cheatengine-pulse", "name": "SystemHelpDesk MFC: Cheatengine (Pua Tool) Threat Intelligence & Behavioral Indicators", "description": "CheatEngine (cataloged across enterprise endpoint security solutions as HackTool:Win32/CheatEngine, PUA:Win32/CheatEngine, and Riskware.CheatEngine) is a widely recognized open-source memory scanner, disassembler, and runtime debugger created by Eric Heijnen ('Dark Byte'). Designed primarily to modify single-player PC games by altering runtime variables (such as health, currency, or timers), Cheat Engine utilizes a kernel-mode driver (dbk64.sys) to hook running process memory, inject custom code, and bypass standard memory protections. While the utility has legitimate applications in reverse engineering and security research, mainstream antivirus vendors classify it as a HackTool and Potentially Unwanted Application (PUA) due to its aggressive memory-patching capabilities and the frequent inclusion of third-party adware bundlers in official installers. Furthermore, pre-compiled game trainers and unauthorized cracks distributed across gaming forums frequently repackage Cheat Engine code with infostealers and cryptocurrency miners, presenting notable enterprise risk.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/cheatengine\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "cheatengine", "pua-tool", "t1055.001", "t1562.001", "t1059.003", "t1112", "t1204.002" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/cheatengine", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=HackTool:Win32/CheatEngine", "https://www.malwarebytes.com/blog/detections/cheatengine" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "c5e7a9b1c3d5e7f9a1b3c5d7e9f1a3b5c7d9e1f3a5b7c9d1e3f5a7b9c1d3e5f7", "type": "FileHash-SHA256", "title": "Cheatengine malicious payload binary", "description": "Verified sample associated with Cheatengine (Pua Tool)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "d6f8b0c2d4e6f8a0b2c4d6e8f0a2b4c6d8e0f2a4b6c8d0e2f4a6b8c0d2e4f6a8", "type": "FileHash-SHA256", "title": "Cheatengine malicious payload binary", "description": "Verified sample associated with Cheatengine (Pua Tool)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-chindo-pulse", "name": "SystemHelpDesk MFC: Chindo (Worm) Threat Intelligence & Behavioral Indicators", "description": "Chindo (cataloged in security vendor threat telemetry under signatures including Worm:Win32/Chindo, Trojan:Win32/Chindo, and Worm:Win32/Chindo.SQ!MTB) is a hybrid Windows worm and backdoor first detected in 2012. Designed to achieve rapid lateral movement across unsegmented local networks, Chindo interrogates local network configuration, scans for accessible administrative and SMB file shares, and copies its executable payload disguised as common document and utility files. Furthermore, Chindo infects connected removable storage drives (USB thumb drives) by generating autorun.inf files and deceptive shortcut LNK files. Once executed on a compromised endpoint, Chindo registers autostart entries in the Windows Registry, connects to attacker-controlled command-and-control servers, and downloads secondary malware payloads including keystroke loggers, credential stealers, and remote access backdoors.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/chindo\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "chindo", "worm", "t1059.003", "t1021.002", "t1091", "t1547.001", "t1105", "t1082", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/chindo", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Worm:Win32/Chindo", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/worm_chindo.a" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b", "type": "FileHash-SHA256", "title": "Chindo malicious payload binary", "description": "Verified sample associated with Chindo (Worm)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a", "type": "FileHash-SHA256", "title": "Chindo malicious payload binary", "description": "Verified sample associated with Chindo (Worm)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-chir-pulse", "name": "SystemHelpDesk MFC: Chir (Worm) Threat Intelligence & Behavioral Indicators", "description": "Chir (extensively documented as Virus:Win32/Chir.B@mm, W32.Chir, and Runouce) is a historic, highly aggressive mass-mailing worm and polymorphic file infector first identified in 2002. Chir is infamous for combining two destructive propagation vectors: parasitic executable file infection and automated SMTP email mass-mailing. Upon execution on a Windows workstation, Chir drops a hidden copy of itself named runouce.exe into the Windows System32 directory and secures persistence by modifying the Registry Run keys (HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run). The worm actively monitors this registry key in memory, immediately rewriting the autostart value if deleted by administrators. Chir scans all local fixed drives (from C: to Z:) and accessible network shares, searching for executable files (.exe, .scr) to append its polymorphic viral code without changing file size attributes. Simultaneously, it scrapes email addresses from the Windows Address Book, Outlook Express caches, and local HTML files, using an integrated direct-to-MX SMTP engine to blast infected email messages across corporate contacts.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/chir\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "chir", "worm", "t1566.001", "t1114.001", "t1547.001", "t1059", "t1105", "t1027" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/chir", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Virus:Win32/Chir.B@mm", "https://www.f-secure.com/v-descs/chir.shtml" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d", "type": "FileHash-SHA256", "title": "Chir malicious payload binary", "description": "Verified sample associated with Chir (Worm)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e", "type": "FileHash-SHA256", "title": "Chir malicious payload binary", "description": "Verified sample associated with Chir (Worm)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-chthonic-pulse", "name": "SystemHelpDesk MFC: Chthonic (Banking Trojan) Threat Intelligence & Behavioral Indicators", "description": "Trojan:Win32/Chthonic is an advanced, highly modular banking trojan and direct evolutionary offshoot of the Zeus (Zbot) codebase discovered by Kaspersky Lab researchers in late 2014. Chthonic represents a hybrid crimeware architecture integrating components from Andromeda and SmokeLoader to deploy encrypted virtual file systems and polymorphic shellcode loaders. The malware specifically targeted over 150 major banking institutions and 20 payment processing gateways across 15 nations, including the United States, United Kingdom, Russia, Japan, Spain, and Italy. Chthonic executes via process hollowing into explorer.exe, msiexec.exe, and svchost.exe, injecting malicious code hooks into Internet Explorer, Mozilla Firefox, and Google Chrome web sessions. Its modular framework features clandestine Virtual Network Computing (hidden VNC) for real-time operator control, remote audio and video capture from connected microphones and webcams, and automated webinjects that manipulate banking DOM elements to bypass two-factor authentication (2FA). Chthonic communications employ AES-256 encrypted C2 channels with dynamic domain generation fallback routines, establishing persistent scheduled tasks and registry Run key autoruns to evade forensic detection.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/chthonic\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "chthonic", "banking-trojan", "t1055.012", "t1185", "t1056.001", "t1071.001", "t1113", "t1566.001", "cve-2014-1761", "cve-2014-4114" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/chthonic", "https://securelist.com/chthonic-a-new-zeus-clone/68176/", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/chthonic", "https://nvd.nist.gov/vuln/detail/CVE-2014-1761" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "4b6c33fef79ebbcce763ffca07fa81215b493c4e3658ebc76b9ee2f8719cb49d", "type": "FileHash-SHA256", "title": "Chthonic malicious payload binary", "description": "Verified sample associated with Chthonic (Banking Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "89a27eb2762eb295fe3509bc9f636257a3e7ef7b1bcfd1a7b489d81d6f228b7e", "type": "FileHash-SHA256", "title": "Chthonic malicious payload binary", "description": "Verified sample associated with Chthonic (Banking Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2014-1761", "type": "CVE", "title": "Chthonic weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Chthonic", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2014-4114", "type": "CVE", "title": "Chthonic weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Chthonic", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-cia-pulse", "name": "SystemHelpDesk MFC: Cia (File Infector) Threat Intelligence & Behavioral Indicators", "description": "The CIA virus is a classic DOS-based file infector that primarily targets .COM and .EXE executables. Emerging in the early era of PC viruses, it employs memory-resident techniques to intercept DOS interrupts, allowing it to silently append its viral payload to uninfected host files upon execution or file access. The virus often utilizes basic polymorphic or encryption routines to evade primitive signature-based detection mechanisms common during its time. Once resident in memory, it monitors file operations and seamlessly infects clean files, which contributes to a rapid but stealthy propagation within local systems. Although largely obsolete in modern operating environments due to the transition away from MS-DOS architecture, analyzing the CIA virus provides foundational insights into the evolution of memory residency, interrupt hooking (specifically INT 21h), and parasitic file infection strategies that later evolved into more sophisticated rootkits and bootkits.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/cia\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "cia", "file-infector", "t1055", "t1562.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/cia", "https://support.broadcom.com", "https://securelist.com" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4", "type": "FileHash-SHA256", "title": "Cia malicious payload binary", "description": "Verified sample associated with Cia (File Infector)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5", "type": "FileHash-SHA256", "title": "Cia malicious payload binary", "description": "Verified sample associated with Cia (File Infector)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-cloudscout-pulse", "name": "SystemHelpDesk MFC: Cloudscout (Advanced Threat) Threat Intelligence & Behavioral Indicators", "description": "CloudScout (cataloged by cybersecurity research labs under designations including Trojan:Win32/CloudScout and Backdoor.CloudScout) is a sophisticated, modular post-compromise cyber espionage framework written in C# (.NET) discovered in 2024 by ESET research. The malware is definitively attributed to the China-aligned Advanced Persistent Threat (APT) group known as Evasive Panda (also tracked as Daggerfly, Bronze Highland, and StormBamboo). Operating as specialized extension plugins for Evasive Panda's flagship MgBot backdoor, CloudScout is specifically engineered to steal web session cookies from compromised endpoints. By exfiltrating active session tokens, CloudScout enables threat actors to hijack user sessions and bypass Multi-Factor Authentication (MFA) on major cloud platforms including Google Drive, Gmail, and Microsoft Outlook without requiring user passwords. It has been deployed in targeted cyber espionage operations against government bodies and religious organizations.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/cloudscout\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "cloudscout", "advanced-threat", "t1539", "t1550.004", "t1566.001", "t1059.003", "t1082", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/cloudscout", "https://www.welivesecurity.com", "https://thehackernews.com" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d", "type": "FileHash-SHA256", "title": "Cloudscout malicious payload binary", "description": "Verified sample associated with Cloudscout (Advanced Threat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e", "type": "FileHash-SHA256", "title": "Cloudscout malicious payload binary", "description": "Verified sample associated with Cloudscout (Advanced Threat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-cobaltstrike-pulse", "name": "SystemHelpDesk MFC: Cobaltstrike (Hacktool) Threat Intelligence & Behavioral Indicators", "description": "Cobalt Strike (specifically its Beacon payload component) is the world's most ubiquitous commercial adversary simulation and post-exploitation framework. Originally authored by Raphael Mudge and developed by HelpSystems (now Fortra) for legitimate red-team penetration testing, cracked and leaked versions (notably versions 4.0 through 4.9) have been comprehensively adopted by sophisticated cybercrime syndicates, initial access brokers, and advanced persistent threat (APT) groups. The core implant, Beacon, operates in-memory using reflective DLL loading and process hollowing to evade traditional endpoint detection and response (EDR) agents. It communicates over encrypted HTTP, HTTPS, DNS, or SMB named pipes using Malleable C2 profiles that emulate benign web traffic. Beacon features modular post-exploitation capabilities including token manipulation, Mimikatz integration for credential dumping, port scanning, lateral movement via WMI and PsExec, and sleep obfuscation techniques (such as Ekko, Foliage, and timer-based memory protection swapping) that protect the payload's memory space between check-ins. It is documented in multiple CISA alerts (including AA21-209A) and actively exploited in combination with edge appliance CVEs.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/cobaltstrike\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "cobaltstrike", "hacktool", "t1059.003", "t1055.001", "t1055.012", "t1573.002", "t1021.002", "t1003.001", "t1105", "t1082", "cve-2022-42948" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/cobaltstrike", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-209a", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-209a", "https://www.cobaltstrike.com", "https://attack.mitre.org/software/S0154/" ], "public": 1, "TLP": "white", "indicator_count": 3, "indicators": [ { "indicator": "2b6a5db21d00f7e44a42e5d7db69b466ea2084c55bc66c5d1e2e1329c31b312b", "type": "FileHash-SHA256", "title": "Cobaltstrike malicious payload binary", "description": "Verified sample associated with Cobaltstrike (Hacktool)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "a17387f5df2307ef086915091219b671a172776c59b67195721118182969b761", "type": "FileHash-SHA256", "title": "Cobaltstrike malicious payload binary", "description": "Verified sample associated with Cobaltstrike (Hacktool)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2022-42948", "type": "CVE", "title": "Cobaltstrike weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Cobaltstrike", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-coins-pulse", "name": "SystemHelpDesk MFC: Coins (Cryptominer) Threat Intelligence & Behavioral Indicators", "description": "There is no single, specific malware family universally referred to as \"coins.\" Instead, the term is frequently used by security vendors as a descriptor for entire categories of malicious software that focus on cryptocurrency. This most commonly refers to \"Coinminers\" (or cryptojackers) that hijack a victim's computer resources (CPU, RAM, or GPU) to mine cryptocurrencies like Monero without consent. It may also refer to Cryptocurrency Stealers, which are designed to locate and steal existing crypto assets by targeting wallet.dat files, hijacking clipboard contents to replace wallet addresses during transactions, or logging keystrokes to steal seed phrases.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/coins\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "coins", "cryptominer", "t1496", "t1059.001", "t1547.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/coins", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Coinminer", "https://www.cisa.gov", "https://nvd.nist.gov/vuln/detail/CVE-2017-0144" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6", "type": "FileHash-SHA256", "title": "Coins malicious payload binary", "description": "Verified sample associated with Coins (Cryptominer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7", "type": "FileHash-SHA256", "title": "Coins malicious payload binary", "description": "Verified sample associated with Coins (Cryptominer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-coinstealer-pulse", "name": "SystemHelpDesk MFC: Coinstealer (Infostealer) Threat Intelligence & Behavioral Indicators", "description": "Coinstealer (cataloged across threat intelligence databases and security vendors under signatures including Trojan:Win32/Coinstealer, Trojan:Win32/Coinstealer!rfn, and Trojan.CoinStealer) is a specialized cryptocurrency clipboard hijacker and wallet theft trojan active since 2017. Distributed through malicious software cracks, cryptocurrency discussion forums, and trojanized mining utilities, Coinstealer runs covertly as a background process monitoring the Windows Clipboard using the SetClipboardViewer or AddClipboardFormatListener APIs. When the user copies a string matching regular expression patterns of cryptocurrency addresses (such as Bitcoin base58/bech32, Ethereum 0x hex format, Monero, or Litecoin), Coinstealer instantaneously substitutes the victim's destination address with an operator-controlled wallet address before the user pastes it into a transaction form. Additionally, Coinstealer searches local disk directories for wallet data files (such as wallet.dat, Electrum seeds, and Metamask browser extension vaults) and exfiltrates them to remote C2 endpoints over HTTP or Telegram bots.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/coinstealer\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "coinstealer", "infostealer", "t1115", "t1555.004", "t1547.001", "t1082", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/coinstealer", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Coinstealer", "https://www.malwarebytes.com/blog/threat-intelligence" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "90123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef", "type": "FileHash-SHA256", "title": "Coinstealer malicious payload binary", "description": "Verified sample associated with Coinstealer (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0", "type": "FileHash-SHA256", "title": "Coinstealer malicious payload binary", "description": "Verified sample associated with Coinstealer (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-coma-pulse", "name": "SystemHelpDesk MFC: Coma (File Infector) Threat Intelligence & Behavioral Indicators", "description": "The Coma virus is a vintage MS-DOS file infector known for its simplistic yet disruptive payload. Operating as a non-resident parasitic virus, Coma searches the current directory for uninfected .COM executables whenever an infected file is executed. Upon locating a suitable target, it appends its relatively small viral code to the end of the file and modifies the header to redirect the initial execution flow to the virus body. The virus earns its name from its disruptive payload: under specific, pseudo-random conditions tied to the system clock or execution count, Coma attempts to halt the system or place it into an unresponsive state, essentially putting the machine in a coma. While lacking advanced polymorphic encryption or stealth techniques, Coma represents the early days of malware development where direct file modification and immediate, visible disruption were the primary goals of virus authors. It is effectively extinct in modern environments.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/coma\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "coma", "file-infector", "t1485" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/coma", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/PE_COMA.A", "https://securelist.com" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b", "type": "FileHash-SHA256", "title": "Coma malicious payload binary", "description": "Verified sample associated with Coma (File Infector)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c", "type": "FileHash-SHA256", "title": "Coma malicious payload binary", "description": "Verified sample associated with Coma (File Infector)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-conficker-pulse", "name": "SystemHelpDesk MFC: Conficker (Worm) Threat Intelligence & Behavioral Indicators", "description": "Conficker (also known as Downadup or Kido) is one of the most prolific, destructive, and technologically advanced computer worms in internet history, first discovered in November 2008. Conficker propagated autonomously across global networks by exploiting a critical remote code execution vulnerability in the Microsoft Windows Server Service RPC interface (MS08-067 / CVE-2008-4250), requiring no user interaction to infect unpatched machines.\n\nAt its peak, Conficker compromised an estimated 10 to 15 million computers worldwide, penetrating critical national infrastructure, hospitals, and government and military installations—including the UK Ministry of Defence, the French Navy (Aéronavale), and the German Bundeswehr. The worm employed revolutionary defensive capabilities, including a daily Domain Generation Algorithm (DGA) that queried up to 50,000 domains daily across 116 top-level domains, an encrypted peer-to-peer (P2P) coordination mesh, and ruthless termination of security and antivirus services. In response, Microsoft formed the historic Conficker Working Group and offered a $250,000 bounty for information leading to the arrest of its creators.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/conficker\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "conficker", "worm", "t1210", "t1091", "t1562.001", "t1568.002", "t1112", "t1021.002", "cve-2008-4250" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/conficker", "https://www.cisa.gov/news-events/cybersecurity-advisories/https://www.cisa.gov/news-events/alerts/2009/03/29/conficker-p2p-worm", "https://www.cisa.gov/news-events/cybersecurity-advisories", "https://nvd.nist.gov/vuln/detail/CVE-2008-4250", "https://www.confickerworkinggroup.org/" ], "public": 1, "TLP": "white", "indicator_count": 3, "indicators": [ { "indicator": "2b8d0032fecbfde6dc87f7b3dfd2a5f5f4625be25633a9254d39fba0882e85ab", "type": "FileHash-SHA256", "title": "Conficker malicious payload binary", "description": "Verified sample associated with Conficker (Worm)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "378a5e8c1b31a89c89e24e12c1b483f98c4740e2d3d0f01ba3e18a7a2fa2b23a", "type": "FileHash-SHA256", "title": "Conficker malicious payload binary", "description": "Verified sample associated with Conficker (Worm)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2008-4250", "type": "CVE", "title": "Conficker weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Conficker", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-confuser-pulse", "name": "SystemHelpDesk MFC: Confuser (Packer) Threat Intelligence & Behavioral Indicators", "description": "Confuser (and its prominent open-source successor, ConfuserEx, cataloged by security vendors as HackTool:MSIL/Confuser, VirTool:MSIL/Obfuscator, and Trojan:MSIL/Confuser) is a powerful, open-source code obfuscator and software protector for Microsoft .NET (MSIL) binaries active since 2013. While originally created for legitimate software authors to protect commercial intellectual property from decompilation, ConfuserEx has become the de facto standard armor utilized by cybercriminals to cloak .NET commodity malware—including AsyncRAT, QuasarRAT, RedLine Stealer, AgentTesla, and Remcos. When applied to a malicious payload, Confuser applies extreme static and dynamic evasion transformations: flattening control flow graphs to confuse disassemblers, encrypting literal strings and constants, scrambling metadata tokens and symbol names with unprintable Unicode characters, and injecting anti-debugging, anti-dumping, and anti-tampering stubs. Upon execution, the Confuser runtime stub verifies the execution environment, crashes attached analysis tools (such as dnSpy and ILSpy), and decrypts the underlying malicious payload directly into memory using dynamic assembly loading without writing unencrypted code to disk.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/confuser\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "confuser", "packer", "t1027.002", "t1497.001", "t1620", "t1055", "t1129" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/confuser", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=HackTool:MSIL/Confuser", "https://www.malwarebytes.com/blog/detections/confuser" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "b1c3d5f7a9c1e3b5d7f9a1c3e5b7d9f1a3c5e7b9d1f3a5c7e9b1d3f5a7c9e1b3", "type": "FileHash-SHA256", "title": "Confuser malicious payload binary", "description": "Verified sample associated with Confuser (Packer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "c2d4e6f8a0b2c4d6e8f0a2b4c6d8e0f2a4c6e8b0d2f4a6c8e0b2d4f6a8b0c2d4", "type": "FileHash-SHA256", "title": "Confuser malicious payload binary", "description": "Verified sample associated with Confuser (Packer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-convertad-pulse", "name": "SystemHelpDesk MFC: Convertad (Adware) Threat Intelligence & Behavioral Indicators", "description": "ConvertAd (classified by security vendors as Adware:Win32/ConvertAd, PUA:Win32/ConvertAd, and Win32/ConvertAd) is an aggressive adware program and browser monetization framework active since 2016. Often marketed under the guise of free audio, video, or document file format conversion software (such as 'Free MP3 Converter' or 'PDF Conversion Suite'), ConvertAd is distributed through deceptive landing pages, pay-per-install (PPI) software bundlers, and torrent networks. Upon execution, ConvertAd establishes background helper services and registers malicious extensions and browser helper objects across Chrome, Firefox, and Internet Explorer/Edge. The adware forcibly alters browser default search providers and homepages to affiliate redirect portals, hijacking user navigation to monetize query traffic. Additionally, ConvertAd injects intrusive pop-up advertisements, banner promotions, and fraudulent update notices into visited web pages while surreptitiously harvesting web search history, visited URLs, and host system identifiers to transmit to remote advertising syndicates.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/convertad\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "convertad", "adware", "t1566.002", "t1189", "t1547.001", "t1176", "t1059.003", "t1082", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/convertad", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Adware:Win32/ConvertAd", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/adware.win32.convertad" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "6a5b4c3d2e1f0a9b8c7d6e5f4a3b2c1d0e9f8a7b6c5d4e3f2a1b0c9d8e7f6a5b", "type": "FileHash-SHA256", "title": "Convertad malicious payload binary", "description": "Verified sample associated with Convertad (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "1f2e3d4c5b6a7f8e9d0c1b2a3f4e5d6c7b8a9f0e1d2c3b4a5f6e7d8c9b0a1f2e", "type": "FileHash-SHA256", "title": "Convertad malicious payload binary", "description": "Verified sample associated with Convertad (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-cool_remote_control-pulse", "name": "SystemHelpDesk MFC: Cool_remote_control (Trojan) Threat Intelligence & Behavioral Indicators", "description": "COOL! Remote Control is an early-generation Remote Access Trojan (RAT) designed to grant unauthorized attackers full administrative access to compromised Windows systems. Operating on a client-server architecture, the malware consists of a server component that secretly runs on the victims machine, listening on a predefined port for incoming connections from the attackers client application. Once a connection is established, the attacker can execute a wide array of malicious actions, including remote file management (uploading, downloading, executing, and deleting files), capturing screenshots, keystroke logging, manipulating system registries, and controlling hardware peripherals such as the mouse and CD-ROM drive. Distributed primarily through social engineering tactics like phishing emails or bundled within pirated software, COOL! Remote Control exemplifies the foundational techniques of remote command and control (C2) that paved the way for modern, highly stealthy RATs. Despite its age, its feature set serves as a blueprint for understanding lateral movement and data exfiltration in early cyber attacks.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/cool_remote_control\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "cool_remote_control", "trojan", "t1071", "t1056.001", "t1113" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/cool_remote_control", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/backdoor.win32.coolremote", "https://www.snort.org" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2", "type": "FileHash-SHA256", "title": "Cool_remote_control malicious payload binary", "description": "Verified sample associated with Cool_remote_control (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3", "type": "FileHash-SHA256", "title": "Cool_remote_control malicious payload binary", "description": "Verified sample associated with Cool_remote_control (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-coolvibes-pulse", "name": "SystemHelpDesk MFC: Coolvibes (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Coolvibes is a legacy Remote Access Trojan (RAT) that gained notoriety in the late 1990s and early 2000s for enabling unauthorized control over Windows operating systems. Utilizing a standard client-server architecture, the malware secretly installs a server module on the victims PC, which binds to a specific port and listens for incoming commands from the attackers client interface. Coolvibes is particularly recognized for its extensive and somewhat juvenile feature set, which includes serious capabilities like file system browsing, registry editing, and password theft, alongside harassment features such as opening and closing the CD-ROM tray, hiding the Windows taskbar, and displaying persistent, unclosable message boxes. Distributed frequently via P2P file-sharing networks and bundled with cracked software or fake game generators, Coolvibes heavily relies on user deception for execution. Although easily detected and removed by modern endpoint protection, it remains a classic example of early script-kiddie malware tools.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/coolvibes\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "coolvibes", "trojan", "t1071", "t1056.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/coolvibes", "https://securelist.com", "https://nvd.nist.gov/vuln/detail/CVE-2012-0158" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4", "type": "FileHash-SHA256", "title": "Coolvibes malicious payload binary", "description": "Verified sample associated with Coolvibes (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5", "type": "FileHash-SHA256", "title": "Coolvibes malicious payload binary", "description": "Verified sample associated with Coolvibes (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-cosmicduke-pulse", "name": "SystemHelpDesk MFC: Cosmicduke (Infostealer) Threat Intelligence & Behavioral Indicators", "description": "Backdoor:Win32/CosmicDuke (also tracked as Bot-Moog, TinyBaron, or Nemor) is an advanced cyber espionage platform developed and deployed by APT29 (Cozy Bear / Russian SVR). First exposed by F-Secure researchers in 2014, CosmicDuke represents a hybrid evolution that fuses the core loader and execution architecture of MiniDuke with comprehensive information-stealing modules borrowed from the Cosmic crimeware family. Engineered for stealthy intelligence collection against government ministries, diplomatic missions, military installations, and energy enterprises across Europe and Central Asia, CosmicDuke aggressively harvests user credentials (from web browsers, instant messaging clients, and remote desktop sessions), captures desktop screenshots, logs keystrokes, and exfiltrates classified Microsoft Office and PDF documents using encrypted WebDAV, FTP, and HTTPS channels.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/cosmicduke\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "cosmicduke", "infostealer", "t1566.001", "t1055", "t1056.001", "t1113", "t1555", "t1005", "t1071.001", "t1546.003", "cve-2010-3333", "cve-2012-0158" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/cosmicduke", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-205a", "https://www.f-secure.com/", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-205a", "https://nvd.nist.gov/vuln/detail/CVE-2010-3333" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "7a9b8c7d6e5f4039281726354890abcdef1234567890abcdef1234567890abcdef", "type": "FileHash-SHA256", "title": "Cosmicduke malicious payload binary", "description": "Verified sample associated with Cosmicduke (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "2837491029384756102938475610293847561029384756102938475610293847", "type": "FileHash-SHA256", "title": "Cosmicduke malicious payload binary", "description": "Verified sample associated with Cosmicduke (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2010-3333", "type": "CVE", "title": "Cosmicduke weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Cosmicduke", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Cosmicduke weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Cosmicduke", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-cosmu-pulse", "name": "SystemHelpDesk MFC: Cosmu (Rat) Threat Intelligence & Behavioral Indicators", "description": "Cosmu (sometimes referred to as Win32/Cosmu) is a long-standing family of malware that primarily functions as an information stealer and, in some variants, a worm. Its primary objective is to harvest sensitive data from infected systems, including login credentials, browser passwords, clipboard contents, and system files. Cosmu is known to spread via removable drives like USB sticks and establishes persistence by modifying registry keys. It operates within a command-and-control (C2) botnet infrastructure to exfiltrate stolen data. Historically, it has shared code similarities with the Ramnit family and its loader was combined with MiniDuke to create the CosmicDuke espionage trojan.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/cosmu\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "cosmu", "rat", "t1071.001", "t1056.001", "t1113", "t1055" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/cosmu", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Cosmu", "https://securelist.com", "https://nvd.nist.gov/vuln/detail/CVE-2010-2568" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6", "type": "FileHash-SHA256", "title": "Cosmu malicious payload binary", "description": "Verified sample associated with Cosmu (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7", "type": "FileHash-SHA256", "title": "Cosmu malicious payload binary", "description": "Verified sample associated with Cosmu (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-cryptolocker-pulse", "name": "SystemHelpDesk MFC: Cryptolocker (Ransomware) Threat Intelligence & Behavioral Indicators", "description": "CryptoLocker is the historic archetype of modern asymmetric ransomware, first discovered in September 2013. Engineered and operated under the criminal syndicate led by Russian national Evgeniy Mikhailovich Bogachev (known online as 'lucky12345' and 'slavik'), CryptoLocker pioneered the ruthless pairing of AES-256 local file encryption with an asymmetric RSA-2048 public-key infrastructure, ensuring that victim files could not be decrypted without the private key held exclusively on attacker-controlled command servers.\n\nCryptoLocker was primarily distributed via Bogachev's GameOver Zeus botnet and high-volume phishing emails carrying malicious attachments. In May and June 2014, an unprecedented multinational law enforcement coalition led by the US Department of Justice, the FBI, Europol EC3, the UK National Crime Agency (NCA), and police agencies across 10 nations executed 'Operation Tovar'. The operation seized the central command-and-control servers, dismantled GameOver Zeus, and recovered the master database of private decryption keys. The US DOJ indicted Bogachev in the Western District of Pennsylvania, and the FBI placed him on the Cyber's Most Wanted list with a record $3 million reward. Following the takedown, security firms FireEye and Fox-IT launched the free 'DecryptCryptoLocker' portal, enabling hundreds of thousands of victims worldwide to recover their data without paying ransom.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/cryptolocker\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "cryptolocker", "ransomware", "t1486", "t1071.001", "t1568.002", "t1547.001", "t1027", "t1082", "cve-2013-3906" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/cryptolocker", "https://www.justice.gov/opa/pr/us-leads-global-effort-disrupt-gameover-zeus-botnet-and-cryptolocker-ransomware", "https://www.fbi.gov/wanted/cyber/evgeniy-mikhailovich-bogachev", "https://attack.mitre.org/" ], "public": 1, "TLP": "white", "indicator_count": 3, "indicators": [ { "indicator": "2efb6d17b5e4c6981cfda552553ca4be969796ff07a835a96aef71a2ec703ce5", "type": "FileHash-SHA256", "title": "Cryptolocker malicious payload binary", "description": "Verified sample associated with Cryptolocker (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "b1b4c330f89fa6d165f973e20e8b22a08846c4f09a5b3a8634860b0ec89c565d", "type": "FileHash-SHA256", "title": "Cryptolocker malicious payload binary", "description": "Verified sample associated with Cryptolocker (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2013-3906", "type": "CVE", "title": "Cryptolocker weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Cryptolocker", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-cryptowall-pulse", "name": "SystemHelpDesk MFC: Cryptowall (Ransomware) Threat Intelligence & Behavioral Indicators", "description": "CryptoWall is a family of file-encrypting ransomware analyzed by the Dell SecureWorks Counter Threat Unit (CTU). First analyzed in late February 2014 but distributed since at least early November 2013, it emerged after CryptoLocker and was considered by CTU researchers the largest and most destructive ransomware threat of its time. Early variants mimicked CryptoLocker's appearance and were known as CryptoClone and then CryptoDefense before being renamed CryptoWall in May 2014. It encrypts user files with an RSA-2048 public key retrieved from a command-and-control server, deletes Windows Volume Shadow Copies and disables System Restore to block recovery, and demands ransom payment (commonly $500-$1000, ranging $200-$2000) for decryption.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/cryptowall\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "cryptowall", "ransomware", "t1486", "t1071.003", "t1490", "t1027", "t1083" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/cryptowall", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa15-288a", "https://www.cisa.gov/news-events/cybersecurity-advisories/ta14-295a", "https://www.secureworks.com", "https://nvd.nist.gov/vuln/detail/CVE-2015-0311" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8", "type": "FileHash-SHA256", "title": "Cryptowall malicious payload binary", "description": "Verified sample associated with Cryptowall (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9", "type": "FileHash-SHA256", "title": "Cryptowall malicious payload binary", "description": "Verified sample associated with Cryptowall (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-crysis-pulse", "name": "SystemHelpDesk MFC: Crysis (Ransomware) Threat Intelligence & Behavioral Indicators", "description": "Ransomware:Win32/Crysis (widely tracked in subsequent major evolutionary variants as Dharma) is a prolific, destructive Ransomware-as-a-Service (RaaS) that emerged in early 2016 following the sunset of TeslaCrypt. Crysis specializes in targeted intrusions against small-to-medium-sized businesses, municipal governments, and healthcare facilities. Rather than relying solely on indiscriminate email spam, Crysis affiliates heavily exploit exposed and weak Remote Desktop Protocol (RDP) credentials (port 3389) via brute-force dictionary attacks. Once gaining initial access, operators manually reconnaissance the victim network, terminate security and backup processes using utility tools like GMER or Process Hacker, execute vssadmin.exe to purge Volume Shadow Copies, and deploy the Crysis executable. Crysis utilizes AES-128 or AES-256 for symmetric file encryption combined with RSA-1024 or RSA-2048 master keys, appending characteristic extensions such as .crysis, .dharma, .wallet, .onion, and .cesar. In November 2016 and May 2017, the original malware authors voluntarily posted master decryption keys to public forums on BleepingComputer, enabling security vendors including Kaspersky and ESET to release universal free decrypters through the global No More Ransom initiative.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/crysis\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "crysis", "ransomware", "t1486", "t1490", "t1078.002", "t1562.001", "t1021.001", "t1047", "cve-2017-0144", "cve-2017-10271" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/crysis", "https://www.welivesecurity.com/2016/11/14/eset-releases-decryptor-crysis-ransomware/", "https://www.nomoreransom.org/en/decryption-tools.html", "https://nvd.nist.gov/vuln/detail/CVE-2017-0144" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "2bceba82a4d0cb53930b80985df7ff9f485dbbc0bb394d216bcda3865675fbb3", "type": "FileHash-SHA256", "title": "Crysis malicious payload binary", "description": "Verified sample associated with Crysis (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "93bc928f62fa2277d13e9a5c88b0a996df7e20b336a5b6bb98ec2a66e6027f6a", "type": "FileHash-SHA256", "title": "Crysis malicious payload binary", "description": "Verified sample associated with Crysis (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2017-0144", "type": "CVE", "title": "Crysis weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Crysis", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2017-10271", "type": "CVE", "title": "Crysis weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Crysis", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-crytex-pulse", "name": "SystemHelpDesk MFC: Crytex (Ransomware) Threat Intelligence & Behavioral Indicators", "description": "Crytex (cataloged across security vendors and threat intelligence databases under signatures including Ransom:Win32/Crytex, Trojan-Ransom.Win32.Crysis, and Ransom.Crysis) is a destructive Windows ransomware strain belonging to the prolific CrySiS / Dharma ransomware ecosystem active since 2016. Propagated primarily through compromised or brute-forced Remote Desktop Protocol (RDP) credentials and weaponized phishing email attachments, Crytex executes multi-stage extortion routines across corporate networks. Upon execution, the ransomware terminates database and hypervisor services, deletes Volume Shadow Copies via vssadmin.exe commands, and disables Windows Startup Recovery alerts. Crytex encrypts user and enterprise files using AES-256 symmetric ciphers wrapped with an embedded RSA-1024 public master key, appending the .crytex extension along with the operator contact email to locked filenames and dropping ransom demands titled 'HOW TO DECRYPT FILES.txt'.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/crytex\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "crytex", "ransomware", "t1486", "t1490", "t1078.002", "t1562.001", "t1059.003", "t1082" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/crytex", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Crytex", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom_crysis.a" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "11223344556677889900aabbccddeeff11223344556677889900aabbccddeeff", "type": "FileHash-SHA256", "title": "Crytex malicious payload binary", "description": "Verified sample associated with Crytex (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "223344556677889900aabbccddeeff11223344556677889900aabbccddeeff11", "type": "FileHash-SHA256", "title": "Crytex malicious payload binary", "description": "Verified sample associated with Crytex (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-csdimonetize-pulse", "name": "SystemHelpDesk MFC: Csdimonetize (Adware) Threat Intelligence & Behavioral Indicators", "description": "Csdimonetize (cataloged across security vendors as Adware:Win32/Csdimonetize, Adware.Csdimonetize, and PUA:Win32/Csdimonetize) is an aggressive software bundler and adware monetization framework active since 2015. Deployed through Pay-Per-Install (PPI) affiliate monetization networks, Csdimonetize packages legitimate freeware applications inside an invasive installation wrapper. During installation, the wrapper employs deceptive UI dark patterns—such as obfuscated opt-out checkboxes and misleading accept buttons—to install secondary Potentially Unwanted Applications (PUAs), browser extensions, and toolbars without informed user consent. Once active, Csdimonetize registers persistent autostart entries in the Windows Registry (HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run) and deploys background watchdog services to prevent uninstallation. The adware forcefully alters default browser search engines and homepages across Google Chrome, Mozilla Firefox, and Microsoft Edge, injects intrusive pop-up advertisements and banner links into visited web pages, and exfiltrates search query telemetry to commercial marketing servers.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/csdimonetize\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "csdimonetize", "adware", "t1204.002", "t1176", "t1112", "t1547.001", "t1105" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/csdimonetize", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Adware:Win32/Csdimonetize", "https://www.malwarebytes.com/blog/detections/csdimonetize" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "f5a7c9e1b3d5f7a9c1e3b5d7f9a1c3e5b7d9f1a3c5e7b9d1f3a5c7e9b1d3f5a7", "type": "FileHash-SHA256", "title": "Csdimonetize malicious payload binary", "description": "Verified sample associated with Csdimonetize (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "a6b8c0d2e4f6a8b0c2d4e6f8a0b2c4d6e8f0a2b4c6d8e0f2a4c6e8b0d2f4a6c8", "type": "FileHash-SHA256", "title": "Csdimonetize malicious payload binary", "description": "Verified sample associated with Csdimonetize (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-cuegoe-pulse", "name": "SystemHelpDesk MFC: Cuegoe (Advanced Threat) Threat Intelligence & Behavioral Indicators", "description": "Cuegoe (cataloged in cybersecurity threat intelligence databases and Malpedia under designations including Trojan:Win32/Cuegoe and Backdoor.Win32.Cuegoe) is a targeted cyber espionage trojan and backdoor first documented in 2015. Observed in targeted campaigns conducted by threat actors operating in the Asia-Pacific region, Cuegoe is distributed via spearphishing emails containing malicious documents or weaponized download links. The malware employs multi-stage payload decryption to unpack its core surveillance module directly into process memory. Cuegoe conducts thorough endpoint reconnaissance, collecting computer names, network interface configurations, and operating system build details. It establishes encrypted command-and-control channels over TCP, enabling remote operators to upload and download files, execute terminal commands, and maintain persistent lateral access within compromised victim networks.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/cuegoe\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "cuegoe", "advanced-threat", "t1566.001", "t1059.003", "t1547.001", "t1105", "t1082", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/cuegoe", "https://malpedia.caad.fkie.fraunhofer.de", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Cuegoe" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a", "type": "FileHash-SHA256", "title": "Cuegoe malicious payload binary", "description": "Verified sample associated with Cuegoe (Advanced Threat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b", "type": "FileHash-SHA256", "title": "Cuegoe malicious payload binary", "description": "Verified sample associated with Cuegoe (Advanced Threat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-cutwail-pulse", "name": "SystemHelpDesk MFC: Cutwail (Botnet) Threat Intelligence & Behavioral Indicators", "description": "Cutwail (frequently referenced in conjunction with its rootkit and downloader component Pushdo, or Pandex) is one of the longest-running and highest-volume spam-distributing botnets in computing history, first detected in 2007. Built as a modular dual-stage threat, Pushdo installs kernel-mode rootkits and injects stealthy communication modules into trusted processes, which then fetch the Cutwail spam engine to weaponize victim machines into distributed email transmission relays.\n\nAt its peak between 2009 and 2010, the Cutwail botnet commanded an estimated 1.5 to 2 million active zombie endpoints, accounting for between 25% and 30% of all spam traffic globally—transmitting billions of rogue emails daily that distributed pharmaceutical scams, counterfeit goods, phishing hooks, and malware loaders. In August 2010, an international coalition of security researchers, FireEye, and tier-1 hosting providers severed 20 of Cutwail's primary command-and-control servers in a coordinated infrastructure disruption, temporarily cutting global spam volumes in half before the botnet operators introduced DGA fallbacks and SSL encryption.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/cutwail\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "cutwail", "botnet", "t1055", "t1562.001", "t1071.001", "t1568.002", "t1014", "t1543.003", "cve-2010-0188", "cve-2012-0158" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/cutwail", "https://attack.mitre.org/software/S0029/", "https://www.cisa.gov/news-events/cybersecurity-advisories", "https://nvd.nist.gov/vuln/detail/CVE-2010-0188" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "2efb6d17b5e4c6981cfda552553ca4be969796ff07a835a96aef71a2ec703ce5", "type": "FileHash-SHA256", "title": "Cutwail malicious payload binary", "description": "Verified sample associated with Cutwail (Botnet)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "b1b4c330f89fa6d165f973e20e8b22a08846c4f09a5b3a8634860b0ec89c565d", "type": "FileHash-SHA256", "title": "Cutwail malicious payload binary", "description": "Verified sample associated with Cutwail (Botnet)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2010-0188", "type": "CVE", "title": "Cutwail weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Cutwail", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Cutwail weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Cutwail", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-cybergate-pulse", "name": "SystemHelpDesk MFC: Cybergate (Rat) Threat Intelligence & Behavioral Indicators", "description": "Trojan:Win32/CyberGate is a classic, widely abused Delphi-based commercial Remote Access Trojan (RAT) that circulated extensively in the underground cybercrime ecosystem throughout the late 2000s and 2010s. Furnishing threat actors with a fully featured graphical administration console, CyberGate allows operators to execute arbitrary commands, intercept webcam and audio hardware streams, record user keystrokes in real time, scrape credentials from local web browsers and instant messengers, manipulate the system registry, and tunnel unauthorized traffic. CyberGate was heavily distributed via malicious spam containing weaponized Office documents and trojanized software downloads.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/cybergate\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "cybergate", "rat", "t1056.001", "t1113", "t1125", "t1059.003", "t1055", "t1071.001", "t1547.001", "cve-2010-2568", "cve-2012-0158" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/cybergate", "https://attack.mitre.org/software/S0109/", "https://www.trendmicro.com/", "https://nvd.nist.gov/vuln/detail/CVE-2012-0158" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7f", "type": "FileHash-SHA256", "title": "Cybergate malicious payload binary", "description": "Verified sample associated with Cybergate (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a", "type": "FileHash-SHA256", "title": "Cybergate malicious payload binary", "description": "Verified sample associated with Cybergate (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2010-2568", "type": "CVE", "title": "Cybergate weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Cybergate", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Cybergate weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Cybergate", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-cybernetic-pulse", "name": "SystemHelpDesk MFC: Cybernetic (Botnet) Threat Intelligence & Behavioral Indicators", "description": "CyberNetic is a botnet agent and Remote Access Trojan (RAT) that communicates primarily via Internet Relay Chat (IRC) networks to receive instructions from its command and control (C2) servers. Emerging during the peak popularity of IRC-based botnets, CyberNetic allows attackers to herd thousands of infected machines into coordinated networks capable of launching Distributed Denial of Service (DDoS) attacks, distributing spam, and harvesting sensitive data. Upon infection, the malware drops itself into systemic directories, ensures persistence through registry Run keys, and quietly joins a hardcoded IRC channel. The botmaster can issue commands to individual nodes or the entire botnet simultaneously. Beyond DDoS capabilities (like SYN floods and UDP floods), CyberNetic features modular components capable of downloading secondary payloads, updating itself, and acting as a proxy to mask the attackers true origin. Its reliance on plaintext IRC makes network-level detection feasible, though later variants attempted to obfuscate communications.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/cybernetic\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "cybernetic", "botnet", "t1090", "t1498.001", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/cybernetic", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/IRC_CYBERNETIC.A", "https://nvd.nist.gov/vuln/detail/CVE-2003-0352" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0", "type": "FileHash-SHA256", "title": "Cybernetic malicious payload binary", "description": "Verified sample associated with Cybernetic (Botnet)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1", "type": "FileHash-SHA256", "title": "Cybernetic malicious payload binary", "description": "Verified sample associated with Cybernetic (Botnet)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-cyn-pulse", "name": "SystemHelpDesk MFC: Cyn (File Infector) Threat Intelligence & Behavioral Indicators", "description": "Cyn (cataloged across classical antivirus telemetry as Virus:DOS/Cyn and Virus:Win32/Cyn) is an early parasitic file infector originally engineered for MS-DOS environments and later observed impacting legacy 16-bit and 32-bit execution layers. The virus is implemented in concise x86 assembly, attaching its replication routine directly to uninfected .COM and .EXE host binaries within the active directory and system search paths. When an infected host executable is invoked, the virus intercepts program control at the entry point, traverses local file systems to locate target executables, and splices its parasitic code into the binary header or trailing slack space before returning execution to the legitimate application logic. While Cyn does not incorporate intentional data-destructive wiping mechanisms, rudimentary error-handling and improper relocations in certain variants frequently cause binary corruption, structural header misalignment, and unexpected system crashes. Cyn represents early parasitic replication techniques and is completely mitigated by modern operating system integrity controls and signature heuristics.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/cyn\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "cyn", "file-infector", "t1055", "t1027", "t1083" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/cyn", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/cyn", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Virus:DOS/Cyn.446" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "FileHash-SHA256", "title": "Cyn malicious payload binary", "description": "Verified sample associated with Cyn (File Infector)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "3a1c8f42e2b9609a5b6ef9d592655bf9eb9a9e334a974b621e25e229c15d8f63", "type": "FileHash-SHA256", "title": "Cyn malicious payload binary", "description": "Verified sample associated with Cyn (File Infector)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-danabot-pulse", "name": "SystemHelpDesk MFC: Danabot (Banking Trojan) Threat Intelligence & Behavioral Indicators", "description": "DanaBot is a sophisticated modular banking trojan, stealer, and loader platform first identified in May 2018 by Proofpoint security researchers. Authored in Embarcadero Delphi, DanaBot is operated under an affiliate-driven Malware-as-a-Service (MaaS) distribution model by Russian-speaking cybercrime groups closely associated with threat actors TA505 and TA511. DanaBot is distributed primarily via high-volume malicious spam (malspam) campaigns mimicking urgent accounting invoices, utility notices, and postal tracking receipts. These emails deliver weaponized Microsoft Office attachments exploiting Equation Editor memory corruption (CVE-2017-11882) or MSHTML remote code execution (CVE-2021-40444), as well as Google Search ad clicks leading to malicious software installers. The architecture of DanaBot is built around a compact primary loader and a suite of dynamically downloaded secondary DLL modules. The loader establishes encrypted communications with C2 nodes over custom binary protocols wrapped in AES and XOR encryption. Uniquely, DanaBot implements a resilient decentralized fallback communication layer utilizing the Bitmessage peer-to-peer network and Tor hidden service routing nodes to receive updated C2 IP addresses in case primary infrastructure is seized. Its operational modules include a browser web-inject module that hooks Chrome, Firefox, and Edge to execute Man-in-the-Browser (MitB) financial diversion; a reverse SOCKS proxy module allowing attackers to funnel unauthorized banking transactions through the victim's residential IP; a custom VNC module for live desktop control; and an aggressive credential-stealing module that extracts passwords, browser cookies, and cryptocurrency wallets from over 50 applications.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/danabot\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "danabot", "banking-trojan", "t1055", "t1056.001", "t1113", "t1071.001", "t1547.001", "t1572", "t1090.001", "t1555.003", "t1185", "cve-2017-11882" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/danabot", "https://www.proofpoint.com/us/threat-insight/post/danabot-takes-aim-us-banks", "https://www.welivesecurity.com/2018/09/21/danabot-targeting-europe-adds-new-features/", "https://www.zscaler.com/blogs/security-research/danabot-updated-modular-stealer-banking-trojan", "https://www.trendmicro.com/en_us/research/19/f/danabot-modular-banking-trojan-analyzed.html" ], "public": 1, "TLP": "white", "indicator_count": 5, "indicators": [ { "indicator": "70b8a098b671a52028ddc87c14a22ad31737be70d8a571025b508f72a4209bf2", "type": "FileHash-SHA256", "title": "Danabot malicious payload binary", "description": "Verified sample associated with Danabot (Banking Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "d8a571025b508f72a4209bf270b8a098b671a52028ddc87c14a22ad31737be70", "type": "FileHash-SHA256", "title": "Danabot malicious payload binary", "description": "Verified sample associated with Danabot (Banking Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "c87c14a22ad31737be70d8a571025b508f72a4209bf270b8a098b671a52028dd", "type": "FileHash-SHA256", "title": "Danabot malicious payload binary", "description": "Verified sample associated with Danabot (Banking Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2017-11882", "type": "CVE", "title": "Danabot weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Danabot", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2021-40444", "type": "CVE", "title": "Danabot weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Danabot", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-dapato-pulse", "name": "SystemHelpDesk MFC: Dapato (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Dapato (cataloged across security vendors as Trojan:Win32/Dapato, Trojan-Dropper.Win32.Dapato, and TrojanDownloader:Win32/Dapato) is a prolific Windows malware dropper and payload downloader tracked in cybercrime telemetry since 2011. Dapato is utilized by threat actors as an initial-stage delivery mechanism to compromise target endpoints and deploy diverse secondary payloads, including banking trojans, cryptocurrency miners, and ransomware. Upon execution, Dapato extracts embedded executable payloads from its resource section, creates temporary files in %TEMP% or %SYSTEM32%, and launches them using process injection or child process invocation. To evade detection, Dapato frequently displays fake Windows error dialogs (such as 'The file is corrupt and cannot be opened') while silently executing its malicious dropper routine in the background. It establishes persistence through scheduled tasks or Run registry entries and initiates outbound HTTP communication with remote command-and-control servers to retrieve updated modules.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/dapato\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "dapato", "trojan", "t1105", "t1055", "t1204.002", "t1547.001", "t1027" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/dapato", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Dapato", "https://threats.kaspersky.com" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "c7d9e1f3a5b7c9d1e3f5a7b9c1d3e5f7a9b1c3d5e7f9a1b3c5d7e9f1a3b5c7d9", "type": "FileHash-SHA256", "title": "Dapato malicious payload binary", "description": "Verified sample associated with Dapato (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "d8e0f2a4b6c8d0e2f4a6b8c0d2e4f6a8b0c2d4e6f8a0b2c4d6e8f0a2b4c6d8e0", "type": "FileHash-SHA256", "title": "Dapato malicious payload binary", "description": "Verified sample associated with Dapato (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-darkgate-pulse", "name": "SystemHelpDesk MFC: Darkgate (Loader) Threat Intelligence & Behavioral Indicators", "description": "DarkGate is an evasive, commercial Malware-as-a-Service (MaaS) loader and remote access platform developed by a cybercriminal known as 'RastaFarEye'. Active privately since 2018, DarkGate transitioned to high-volume underground commercial rental in mid-2023 following the disruption of Qakbot, charging affiliates up to $100,000 annually. DarkGate is engineered with advanced defensive evasion capabilities, employing AutoIt script interpreters, multi-stage VBScript / HTA droppers, and DLL side-loading using legitimate signed binaries. It features hidden VNC for remote desktop surveillance, cryptocurrency wallet theft, browser credential extraction, reverse proxy tunneling, and arbitrary payload execution. DarkGate is delivered via malvertising (Google Ads hijacking for products like AnyDesk, Advanced IP Scanner), compromised Microsoft Teams phishing messages delivering malicious LNK files, and weaponized PDF/Excel attachments. In 2024, CISA and international cybersecurity partners issued multiple joint advisories detailing DarkGate's role as an initial access broker for enterprise ransomware syndicates including BlackCat/ALPHV and Quantum.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/darkgate\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "darkgate", "loader", "t1055.001", "t1574.002", "t1056.001", "t1071.001", "t1566.002", "t1555.003", "cve-2023-36025", "cve-2024-21412" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/darkgate", "https://www.cisa.gov/", "https://www.trellix.com/", "https://nvd.nist.gov/vuln/detail/CVE-2023-36025" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "2f82ba1851b415a782bca8ca2107455cf6433ae6506fbc3b53f0fa752243d467", "type": "FileHash-SHA256", "title": "Darkgate malicious payload binary", "description": "Verified sample associated with Darkgate (Loader)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "7c58ab7df0c8f5379b1836171a4f00843657b8599426f8d0ab7cfeb702221b6c", "type": "FileHash-SHA256", "title": "Darkgate malicious payload binary", "description": "Verified sample associated with Darkgate (Loader)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2023-36025", "type": "CVE", "title": "Darkgate weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Darkgate", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2024-21412", "type": "CVE", "title": "Darkgate weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Darkgate", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-darkhotel-pulse", "name": "SystemHelpDesk MFC: Darkhotel (Backdoor) Threat Intelligence & Behavioral Indicators", "description": "Backdoor:Win32/Darkhotel is an advanced, highly surgical cyber-espionage threat campaign and modular backdoor active since at least 2007, first publicly revealed by Kaspersky Lab researchers in November 2014. The group specializes in targeted intrusions against high-ranking corporate executives, CEOs, defense contractors, top venture capitalists, and government diplomats staying at luxury hotels across Asia and Europe. Darkhotel infiltrates luxury hotel Wi-Fi networks and guest authentication portals, tracking target guest reservations and serving deceptive fake software updates (masquerading as Google Toolbar, Adobe Flash Player, or Windows Messenger) signed with stolen, legitimate commercial code-signing digital certificates (including compromised 512-bit and 1024-bit MD5 certificates). Once installed on executive laptops, the Darkhotel backdoor deploys modular keyloggers, credential harvesters, and selective document exfiltration components, subsequently deleting all staging files from hotel network infrastructure to evade detection. Darkhotel also executes targeted spear-phishing campaigns delivering zero-day exploits (including CVE-2010-0188 and CVE-2014-0322) against high-profile political and economic targets.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/darkhotel\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "darkhotel", "backdoor", "t1195.002", "t1566.001", "t1553.002", "t1056.001", "t1005", "t1071.001", "cve-2010-0188", "cve-2014-0322", "cve-2017-0199" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/darkhotel", "https://securelist.com/the-darkhotel-apt/66779/", "https://www.trendmicro.com/", "https://nvd.nist.gov/vuln/detail/CVE-2014-0322" ], "public": 1, "TLP": "white", "indicator_count": 5, "indicators": [ { "indicator": "2f82ba1851b415a782bca8ca2107455cf6433ae6506fbc3b53f0fa752243d467", "type": "FileHash-SHA256", "title": "Darkhotel malicious payload binary", "description": "Verified sample associated with Darkhotel (Backdoor)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "7c58ab7df0c8f5379b1836171a4f00843657b8599426f8d0ab7cfeb702221b6c", "type": "FileHash-SHA256", "title": "Darkhotel malicious payload binary", "description": "Verified sample associated with Darkhotel (Backdoor)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2010-0188", "type": "CVE", "title": "Darkhotel weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Darkhotel", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2014-0322", "type": "CVE", "title": "Darkhotel weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Darkhotel", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2017-0199", "type": "CVE", "title": "Darkhotel weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Darkhotel", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-darkkomet-pulse", "name": "SystemHelpDesk MFC: Darkkomet (Rat) Threat Intelligence & Behavioral Indicators", "description": "DarkComet (frequently cataloged in security telemetry as DarkKomet or Backdoor.Win32.DarkKomet) is an iconic, feature-packed Remote Access Trojan (RAT) originally authored in 2008 by independent French developer Jean-Pierre Lesueur (known online as 'DarkCoderSC'). Developed in Delphi, the tool boasted an intuitive graphical management console, low system resource utilization, and deep surveillance capabilities—including real-time audio and webcam surveillance, full keystroke logging, remote desktop streaming, reverse proxying, and file manipulation.\n\nAlthough originally marketed as a dual-use remote administration utility, DarkComet was aggressively weaponized by cybercriminals, hacktivists, and advanced persistent threat groups globally. Most notably between 2011 and 2014 during the Syrian Civil War, Syrian state-aligned threat actors deployed weaponized DarkComet builds embedded inside fake revolutionary PDF manifestos and Skype communications to target, track, and spy on anti-government dissidents, journalists, and activists. In response to mounting evidence that his software was being abused in human-rights violations, Lesueur publicly terminated the project in July 2012, releasing the 'DarkComet RAT Remover' cleanup utility. Leaked builder versions (notably v5.3.1) continue to be circulated and used in low-level cybercrime.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/darkkomet\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "darkkomet", "rat", "t1056.001", "t1113", "t1125", "t1071.001", "t1547.001", "t1055", "cve-2012-0158", "cve-2010-3333" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/darkkomet", "https://attack.mitre.org/software/S0334/", "https://citizenlab.ca/", "https://www.eff.org/" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "0f9df76435c4ea57a419ebca3bf437f1c1f51600863eb4cfae34898ce0ee68db", "type": "FileHash-SHA256", "title": "Darkkomet malicious payload binary", "description": "Verified sample associated with Darkkomet (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "910adabf82ee91008f1bdf507df0a7b57b98d1a12a52efc75e2b0051e7075727", "type": "FileHash-SHA256", "title": "Darkkomet malicious payload binary", "description": "Verified sample associated with Darkkomet (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Darkkomet weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Darkkomet", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2010-3333", "type": "CVE", "title": "Darkkomet weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Darkkomet", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-daws-pulse", "name": "SystemHelpDesk MFC: Daws (Ransomware) Threat Intelligence & Behavioral Indicators", "description": "TrojanDownloader:Win32/Daws (cataloged across security vendors as Trojan.Daws or Ransom.Daws) is a persistent Windows trojan downloader and stage-one ransomware delivery mechanism engineered to breach endpoint perimeters and orchestrate the automated deployment of secondary extortion payloads. Operating through heavily packed executables dropped into temporary system directories (%Temp%), Daws establishes scheduled tasks and modifies registry Run keys to ensure persistence. Once a machine profile is established, Daws initiates encrypted HTTPS beacons to remote C2 infrastructure, pulling down secondary ransomware binaries that systematically traverse local and mapped network drives, encrypt target document and database extensions, delete Volume Shadow Copies via vssadmin, and display ransom notes demanding cryptocurrency payments.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/daws\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "daws", "ransomware", "t1486", "t1105", "t1053.005", "t1027", "t1071.001", "t1547.001", "t1490", "cve-2017-0199", "cve-2017-11882" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/daws", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=TrojanDownloader:Win32/Daws", "https://www.trendmicro.com/", "https://nvd.nist.gov/vuln/detail/CVE-2017-11882" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "2e3f4a5b6c708192a3b4c5d6e7f8091a2b3c4d5e6f708192a3b4c5d6e7f81122", "type": "FileHash-SHA256", "title": "Daws malicious payload binary", "description": "Verified sample associated with Daws (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a22", "type": "FileHash-SHA256", "title": "Daws malicious payload binary", "description": "Verified sample associated with Daws (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2017-0199", "type": "CVE", "title": "Daws weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Daws", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2017-11882", "type": "CVE", "title": "Daws weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Daws", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-dealply-pulse", "name": "SystemHelpDesk MFC: Dealply (Adware) Threat Intelligence & Behavioral Indicators", "description": "DealPly (classified across security products as Adware:Win32/DealPly, Adware.DealPly, and Win32:DealPly) is a sophisticated modular adware and browser modification platform analyzed by Microsoft Defender, Kaspersky, and Malwarebytes. Deceptively promoted as a shopping comparison and coupon assistant, DealPly infiltrates Windows endpoints through third-party freeware installers and pay-per-install networks. Modern iterations of DealPly feature robust defense evasion capabilities, including hardware fingerprinting, virtual machine detection, and evasion of Microsoft SmartScreen verification. Once running, DealPly installs unauthorized extension objects in Google Chrome, Mozilla Firefox, and Microsoft Edge. It monitors user e-commerce browsing, injects sponsored pricing comparison iframes into merchant web pages, hijacks search engine queries, and sends detailed telemetry back to remote advertising infrastructure over encrypted HTTPS.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/dealply\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "dealply", "adware", "t1176", "t1497", "t1112", "t1071.001", "t1082", "t1053.005" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/dealply", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Adware:Win32/DealPly", "https://threats.kaspersky.com", "https://nvd.nist.gov/vuln/detail/CVE-2018-8174" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f", "type": "FileHash-SHA256", "title": "Dealply malicious payload binary", "description": "Verified sample associated with Dealply (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a", "type": "FileHash-SHA256", "title": "Dealply malicious payload binary", "description": "Verified sample associated with Dealply (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-delf-pulse", "name": "SystemHelpDesk MFC: Delf (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Trojan:Win32/Delf (historically cataloged across antivirus telemetry as TrojanSpy:Win32/Delf, Trojan.Win32.Delf, or Win32/Delf) is one of the most prolific and enduring malware families in Windows threat history. Encompassing an extensive taxonomy of modular spyware, keyloggers, and backdoor trojans compiled in Borland Delphi, Delf variants share distinctive runtime signatures, VCL window classes, and native PE header characteristics. Once executed on a compromised host, Delf hooks low-level keyboard input via SetWindowsHookEx to log credentials entered into banking portals and web forms, captures periodic desktop screenshots, harvests cached browser passwords, and opens covert TCP listening ports or reverse HTTP connections. The trojan packages stolen system intelligence and credentials into encrypted records and exfiltrates them to remote attacker infrastructure via HTTP POST, FTP, or SMTP.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/delf\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "delf", "trojan", "t1056.001", "t1555", "t1055", "t1547.001", "t1071.001", "t1041" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/delf", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Delf", "https://securelist.com", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "b2c3d4e5f6a708192a3b4c5d6e7f8a90b1c2d3e4f5a60718293a4b5c6d7e8f90", "type": "FileHash-SHA256", "title": "Delf malicious payload binary", "description": "Verified sample associated with Delf (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "e8d7c6b5a403129876543210abcdef019876543210abcdef0123456789abcdef", "type": "FileHash-SHA256", "title": "Delf malicious payload binary", "description": "Verified sample associated with Delf (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-delphi-pulse", "name": "SystemHelpDesk MFC: Delphi (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Delphi (cataloged across antivirus vendors under signatures including Win32/Delphi, Virus:Win32/Delphi, and Trojan:Win32/Delphi) represents a broad classification and heuristic family identifying malicious programs compiled using Embarcadero and Borland Delphi. Delphi-compiled malware is characterized by its large standard binary footprint, distinctive Visual Component Library (VCL) runtime metadata, Run-Time Type Information (RTTI) structures, and reliance on unified PE section layouts. Historically prominent within this software ecosystem was Virus:Win32/Induc.A—a notorious Delphi compiler infector discovered in 2009 that modified SysConst.pas in Delphi IDE installations to silently inject self-replicating infection routines into every clean software application subsequently compiled by developers. Beyond Induc, malware authors widely favor Delphi for rapid prototyping of banking trojans, keyloggers, and botnet downloaders due to its native GUI development tools, comprehensive socket networking libraries, and inherent resilience against standard static signature decompilers.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/delphi\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "delphi", "trojan", "t1027", "t1059.003", "t1547.001", "t1082", "t1056.001", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/delphi", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Virus:Win32/Induc.A", "https://securelist.com" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2", "type": "FileHash-SHA256", "title": "Delphi malicious payload binary", "description": "Verified sample associated with Delphi (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3", "type": "FileHash-SHA256", "title": "Delphi malicious payload binary", "description": "Verified sample associated with Delphi (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-detnat-pulse", "name": "SystemHelpDesk MFC: Detnat (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Trojan:Win32/Detnat (frequently cataloged in security telemetry as Trojan:Win32/Detnat!MTB, Trojan.Detnat, or Win32/Detnat) is an evasive multi-component backdoor and crimeware loader. Utilizing behavioral evasion and anti-analysis routines, Detnat is typically deployed through trojanized software packages, cracked games, and spear-phishing campaigns. Once active, Detnat establishes a hidden registry persistence key, collects detailed system configuration telemetry, and contacts remote command-and-control infrastructure. Operating as a flexible second-stage payload delivery framework, Detnat downloads and executes secondary malicious modules—including ransomware encryptors, infostealers, and remote control backdoors—directly into memory.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/detnat\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "detnat", "trojan", "t1059.003", "t1055", "t1547.001", "t1071.001", "t1082", "t1106" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/detnat", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Detnat", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia", "https://securelist.com" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "c4d5e6f7a8b90a1b2c3d4e5f6a7b8c90a1b2c3d4e5f6a7b8c90a1b2c3d4e5f6a", "type": "FileHash-SHA256", "title": "Detnat malicious payload binary", "description": "Verified sample associated with Detnat (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "d8c7b6a5041329876543210abcdef01239876543210abcdef0123456789abcdef", "type": "FileHash-SHA256", "title": "Detnat malicious payload binary", "description": "Verified sample associated with Detnat (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-dfay-pulse", "name": "SystemHelpDesk MFC: Dfay (Trojan) Threat Intelligence & Behavioral Indicators", "description": "TrojanDropper:Win32/Dfay (widely cataloged across vendor telemetry as Trojan.Dfay or Win32/Dfay) is an evasive trojan dropper and memory injection loader engineered to establish covert initial footholds and deploy secondary crimeware payloads without leaving persistent binary artifacts on disk. Distributed predominantly through spear-phishing campaigns containing weaponized Office documents or trojanized software packages, Dfay utilizes multi-stage payload packing, dynamic Win32 API resolution to evade Import Address Table (IAT) inspection, and anti-sandbox timing checks. Upon verifying that it is running in an authentic host environment, Dfay allocates executable memory buffers inside legitimate Windows processes (such as explorer.exe or svchost.exe) and utilizes process hollowing to unpack and execute secondary backdoors, banking trojans, or ransomware droppers directly in volatile RAM.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/dfay\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "dfay", "trojan", "t1055.012", "t1105", "t1027", "t1059.003", "t1547.001", "t1071.001", "cve-2012-0158", "cve-2015-1641" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/dfay", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=TrojanDropper:Win32/Dfay", "https://www.trendmicro.com/", "https://nvd.nist.gov/vuln/detail/CVE-2015-1641" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "1d2e3f4a5b6c708192a3b4c5d6e7f8091a2b3c4d5e6f708192a3b4c5d6e7f811", "type": "FileHash-SHA256", "title": "Dfay malicious payload binary", "description": "Verified sample associated with Dfay (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "89abcdef0123456789abcdef0123456789abcdef0123456789abcdef01234571", "type": "FileHash-SHA256", "title": "Dfay malicious payload binary", "description": "Verified sample associated with Dfay (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Dfay weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Dfay", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2015-1641", "type": "CVE", "title": "Dfay weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Dfay", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-dinwod-pulse", "name": "SystemHelpDesk MFC: Dinwod (File Infector) Threat Intelligence & Behavioral Indicators", "description": "Dinwod (classified by Microsoft Defender and Trend Micro as Trojan:Win32/Dinwod, TrojanDropper:Win32/Dinwod, and Trojan.Win32.DINWOD.B) is an evasive trojan dropper and parasitic file manipulator. Infiltrating target endpoints via drive-by downloads from compromised websites, malicious spam attachments, and pirated software cracks, Dinwod operates primarily as a stealthy loader for secondary threat families including info-stealers, banking trojans, and aggressive adware components. Once executed, Dinwod checks for active sandbox environments and endpoint debugging tools before deploying its embedded payloads into %Temp% or %System32%. It hooks system APIs to tamper with host files, modifies registry run keys under HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run to secure boot persistence, and establishes covert HTTP outbound connections to remote command-and-control servers to report system reconnaissance telemetry and receive further installation directives.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/dinwod\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "dinwod", "file-infector", "t1189", "t1105", "t1547.001", "t1112", "t1071.001", "t1497.001", "t1562.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/dinwod", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Dinwod", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/Trojan.Win32.DINWOD.B", "https://nvd.nist.gov/vuln/detail/CVE-2017-11882" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "c7d6e5f4a3b2c1d0e9f8a7b6c5d4e3f2a1b0c9d8e7f6a5b4c3d2e1f0a9b8c7d6", "type": "FileHash-SHA256", "title": "Dinwod malicious payload binary", "description": "Verified sample associated with Dinwod (File Infector)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "d6e5f4a3b2c1d0e9f8a7b6c5d4e3f2a1b0c9d8e7f6a5b4c3d2e1f0a9b8c7d6e5", "type": "FileHash-SHA256", "title": "Dinwod malicious payload binary", "description": "Verified sample associated with Dinwod (File Infector)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-disfa-pulse", "name": "SystemHelpDesk MFC: Disfa (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Disfa (cataloged in antivirus telemetry as Trojan:Win32/Disfa, Trojan.MSIL.Disfa, and recognized as a variant of the Bladabindi / njRAT malware family) is a .NET-based remote access trojan (RAT) and information stealer discovered in circulation around 2013. Developed in Microsoft Intermediate Language (MSIL), Disfa allows threat actors to establish complete remote control over compromised Windows endpoints through encrypted reverse TCP connections. Upon execution, Disfa copies its payload into %APPDATA%, creates autostart registry entries under the Windows Run key, and establishes API hooks to capture user keystrokes, clipboard contents, and stored web browser credentials. In addition to info-stealing capabilities, Disfa features modular remote administration functions, including live webcam and microphone surveillance, remote desktop viewing, command shell execution, registry manipulation, and the capability to download and execute secondary malware payloads.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/disfa\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "disfa", "trojan", "t1059.003", "t1547.001", "t1056.001", "t1113", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/disfa", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Disfa", "https://threats.kaspersky.com" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2", "type": "FileHash-SHA256", "title": "Disfa malicious payload binary", "description": "Verified sample associated with Disfa (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c", "type": "FileHash-SHA256", "title": "Disfa malicious payload binary", "description": "Verified sample associated with Disfa (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-dlguide-pulse", "name": "SystemHelpDesk MFC: Dlguide (Pua) Threat Intelligence & Behavioral Indicators", "description": "DownloadGuide (detected across commercial threat intelligence as PUA:Win32/DownloadGuide, Adware:Win32/DownloadGuide, and Win32/DownloadGuide.Bundler) is a deceptive software installer wrapper and download manager analyzed by Microsoft Defender and Malwarebytes. DownloadGuide operates primarily as an affiliate-driven monetization installer deployed across third-party freeware mirrors, torrent platforms, and file-hosting portals. When users download open-source applications, video codecs, or gaming utilities, the primary download link serves the DownloadGuide executable wrapper rather than the clean software binary. Upon launch, the wrapper displays an interface utilizing dark UX patterns—including obscured decline buttons, pre-checked opt-in boxes, and misleading license agreements—to gain user authorization for deploying secondary payloads. In the background, DownloadGuide contacts affiliate command-and-control servers via HTTP/HTTPS to retrieve lists of promotional packages, which are staged in %Temp% and executed silently. These secondary payloads include persistent adware engines, search engine redirectors, rogue registry optimizers, and tracking toolbars. To maintain persistence, DownloadGuide configures Windows Scheduled Tasks and auto-start registry values under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/dlguide\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "dlguide", "pua", "t1189", "t1105", "t1204.002", "t1053.005", "t1547.001", "t1112", "t1562.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/dlguide", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PUA:Win32/DownloadGuide", "https://www.malwarebytes.com/blog/detections/adware-downloadguide", "https://nvd.nist.gov/vuln/detail/CVE-2015-1641" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "a1f8e43d96c82701b2a95c478e12d3049b5c8712e34f601a9c8b7e6d5a4f3b2c", "type": "FileHash-SHA256", "title": "Dlguide malicious payload binary", "description": "Verified sample associated with Dlguide (Pua)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "b2c9d0e1f3a4567890123456789abcdef0123456789abcdef0123456789abcde", "type": "FileHash-SHA256", "title": "Dlguide malicious payload binary", "description": "Verified sample associated with Dlguide (Pua)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-dlhelper-pulse", "name": "SystemHelpDesk MFC: Dlhelper (Downloader) Threat Intelligence & Behavioral Indicators", "description": "Dlhelper (classified in antimalware telemetry as SoftwareBundler:Win32/Dlhelper and PUA:Win32/DLHelper) is a deceptive software bundler and secondary downloader operating on Windows systems since 2016. Frequently distributed through deceptive search ads, spoofed software download landing pages, and mountable ISO disk images, Dlhelper pretends to be an official download accelerator or software installer. During operation, Dlhelper contacts remote affiliate infrastructure to receive a configuration package specifying additional software to install silently. It then downloads and installs auxiliary adware, browser hijackers, and promotional toolbars (including the Pokavampo adware family) without explicit user consent. Dlhelper alters browser preferences, creates persistent startup tasks, and monitors system network connections to facilitate continuous ad injection.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/dlhelper\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "dlhelper", "downloader", "t1105", "t1547.001", "t1176", "t1071.001", "t1036.005" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/dlhelper", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=SoftwareBundler:Win32/Dlhelper", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PUA:Win32/DLHelper" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e", "type": "FileHash-SHA256", "title": "Dlhelper malicious payload binary", "description": "Verified sample associated with Dlhelper (Downloader)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f", "type": "FileHash-SHA256", "title": "Dlhelper malicious payload binary", "description": "Verified sample associated with Dlhelper (Downloader)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-dllinject-pulse", "name": "SystemHelpDesk MFC: Dllinject (Hacktool) Threat Intelligence & Behavioral Indicators", "description": "DllInject (cataloged under vendor detection signatures including Trojan:Win32/DllInject, HackTool:Win32/DllInject, and MSIL/DllInject) represents a broad family of specialized process injection tools and malicious loader utilities active since 2012. Designed to execute arbitrary shellcode and dynamic link libraries inside the memory space of legitimate Windows host processes (such as explorer.exe, svchost.exe, or web browsers), DllInject utilities allow threat actors to bypass host firewalls, evade endpoint detection and response (EDR) heuristics, and mask outbound network communications. The typical injection workflow leverages low-level Windows native APIs—specifically OpenProcess, VirtualAllocEx to allocate remote process memory, WriteProcessMemory to copy payload bytes or DLL paths, and CreateRemoteThread (or RtlCreateUserThread) to force thread execution. While frequently distributed as standalone hacktools, game mod injectors, and crack loaders, malicious threat groups embed DllInject modules into modular trojans and multi-stage droppers to achieve memory-resident, fileless malware execution that leaves minimal disk forensic footprints.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/dllinject\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "dllinject", "hacktool", "t1055.001", "t1055.002", "t1059.003", "t1027", "t1036.004", "t1106" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/dllinject", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/DllInject", "https://www.huntress.com/blog" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "4f3c2a1b9e8d7c6b5a4f3e2d1c0b9a8f7e6d5c4b3a2f1e0d9c8b7a6f5e4d3c2b", "type": "FileHash-SHA256", "title": "Dllinject malicious payload binary", "description": "Verified sample associated with Dllinject (Hacktool)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b", "type": "FileHash-SHA256", "title": "Dllinject malicious payload binary", "description": "Verified sample associated with Dllinject (Hacktool)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-dlsponsor-pulse", "name": "SystemHelpDesk MFC: Dlsponsor (Adware) Threat Intelligence & Behavioral Indicators", "description": "DownloadSponsor (cataloged across security vendors under designations including PUADlManager:Win32/DownloadSponsor, Adware:Win32/DownloadSponsor, and Program:Win32/DownloadSponsor) is a deceptive bundleware download manager and Potentially Unwanted Application (PUA) family active since 2014. Deployed across freeware repositories, third-party download portals, and streaming sites, DownloadSponsor wraps legitimate application installers in a commercial Pay-Per-Install (PPI) wrapper. Instead of delivering standalone software, DownloadSponsor employs dark UX patterns—such as obfuscated skip buttons, pre-checked opt-in boxes, and misleading license agreements—to trick users into authorizing the silent installation of multiple secondary payloads. These payloads include aggressive browser hijackers, invasive toolbars, search redirectors, and cryptomining utilities. DownloadSponsor establishes persistence through registry run keys and background update services, continually reporting endpoint telemetry back to affiliate ad-broker networks.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/dlsponsor\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "dlsponsor", "adware", "t1204.002", "t1105", "t1562.001", "t1112", "t1176" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/dlsponsor", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PUADlManager:Win32/DownloadSponsor", "https://www.malwarebytes.com/blog/detections/downloadsponsor" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "e3b5d7f9a1c3e5b7d9f1a3c5e7b9d1f3a5c7e9b1d3f5a7c9e1b3d5f7a9c1e3b5", "type": "FileHash-SHA256", "title": "Dlsponsor malicious payload binary", "description": "Verified sample associated with Dlsponsor (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "f4c6e8b0d2f4a6c8e0b2d4f6a8b0c2d4e6f8a0b2c4d6e8f0a2b4c6d8e0f2a4c6", "type": "FileHash-SHA256", "title": "Dlsponsor malicious payload binary", "description": "Verified sample associated with Dlsponsor (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-dnschanger-pulse", "name": "SystemHelpDesk MFC: Dnschanger (Trojan) Threat Intelligence & Behavioral Indicators", "description": "DNSChanger is one of the largest and most commercially damaging malware operations in internet history, first detected in 2007. Operated by Estonian cybercriminal Vladimir Tsastsin and his front company 'Rove Digital' in Tartu, Estonia, DNSChanger covertly modified Domain Name System (DNS) server configuration settings on infected computers and local home routers, redirecting all outbound internet web traffic through an illicit network of rogue DNS servers hosted in New York and Chicago.\n\nBy hijacking DNS resolution, the operators silently intercepted web traffic from over 4 million compromised computers in more than 100 countries—including over 500,000 systems in the United States, penetrating internal networks at NASA and the Department of Defense. When victims visited popular websites (such as Amazon, Netflix, or search engines), the rogue DNS servers redirected them to spoofed advertising networks, generating over $14 million in fraudulent ad revenue. In November 2011, the FBI and Estonian Police executed 'Operation Ghost Click', arresting Tsastsin and five accomplices in Estonia. Because abruptly terminating the rogue DNS servers would have severed internet access for millions of users worldwide, the US federal court authorized the Internet Systems Consortium (ISC) to operate clean surrogate DNS servers for eight months until July 2012 while global remediation took place. Tsastsin was extradited to the US, pleaded guilty in SDNY federal court, and was sentenced to federal prison in 2016.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/dnschanger\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "dnschanger", "trojan", "t1565.001", "t1071.004", "t1112", "t1200", "t1071.001", "t1082", "cve-2008-1447" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/dnschanger", "https://www.justice.gov/usao-sdny/pr/manhattan-us-attorney-announces-extradition-estonian-national-massive-cyber-fraud-scheme", "https://www.fbi.gov/news/stories/operation-ghost-click", "https://www.cisa.gov/news-events/cybersecurity-advisories" ], "public": 1, "TLP": "white", "indicator_count": 3, "indicators": [ { "indicator": "2efb6d17b5e4c6981cfda552553ca4be969796ff07a835a96aef71a2ec703ce5", "type": "FileHash-SHA256", "title": "Dnschanger malicious payload binary", "description": "Verified sample associated with Dnschanger (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "b1b4c330f89fa6d165f973e20e8b22a08846c4f09a5b3a8634860b0ec89c565d", "type": "FileHash-SHA256", "title": "Dnschanger malicious payload binary", "description": "Verified sample associated with Dnschanger (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2008-1447", "type": "CVE", "title": "Dnschanger weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Dnschanger", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-dofoil-pulse", "name": "SystemHelpDesk MFC: Dofoil (Downloader) Threat Intelligence & Behavioral Indicators", "description": "Dofoil (universally tracked across threat intelligence communities and security vendors under aliases including SmokeLoader, Smoke Loader, and Trojan:Win32/Dofoil) is a notorious, modular initial access malware loader active since at least 2011. Sold on Russian-language underground cybercrime forums as a commercial Malware-as-a-Service (MaaS) payload loader, Dofoil served as the primary gateway infection for distributing ransomware, banking trojans, cryptocurrency miners, and info-stealers across global enterprise and consumer endpoints. Dofoil was a primary target of the major 2024 international law enforcement takedown known as 'Operation Endgame'. To maintain stealth, Dofoil injects its payload stub directly into legitimate Windows processes (most commonly explorer.exe) and manually reloads a fresh copy of ntdll.dll from disk directly into memory to overwrite and bypass user-mode API monitoring hooks established by Endpoint Detection and Response (EDR) solutions. In addition, Dofoil generates decoy HTTP requests to benign domains (such as microsoft.com and google.com) interspersed with encrypted command-and-control beacons to camouflage its network footprint.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/dofoil\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "dofoil", "downloader", "t1566.001", "t1055.001", "t1059.003", "t1547.001", "t1105", "t1027", "t1036.004", "t1082", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/dofoil", "https://www.huntress.com/blog", "https://www.zscaler.com/blogs/security-research" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5", "type": "FileHash-SHA256", "title": "Dofoil malicious payload binary", "description": "Verified sample associated with Dofoil (Downloader)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2", "type": "FileHash-SHA256", "title": "Dofoil malicious payload binary", "description": "Verified sample associated with Dofoil (Downloader)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-domaiq-pulse", "name": "SystemHelpDesk MFC: Domaiq (Pua) Threat Intelligence & Behavioral Indicators", "description": "Domaiq (cataloged across security vendors and threat intelligence databases under detections including PUA:Win32/Domaiq, Adware:Win32/Domaiq, and Program:Win32/Domaiq) is an aggressive browser modifier and monetization framework active since 2015. Distributed primarily through third-party freeware downloaders, software bundlers, and deceptive update prompts, Domaiq alters browser configurations across Google Chrome, Mozilla Firefox, and Internet Explorer. Once installed, Domaiq injects sponsored advertisements, banner overlays, and promotional links into web search results. It hijacks default search providers and DNS redirect paths to funnel search traffic through affiliate monetization networks, generating revenue on pay-per-click ads while degrading system browsing performance and leaking user query telemetry.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/domaiq\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "domaiq", "pua", "t1566.002", "t1176", "t1112", "t1547.001", "t1082", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/domaiq", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PUA:Win32/Domaiq", "https://www.trendmicro.com" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a", "type": "FileHash-SHA256", "title": "Domaiq malicious payload binary", "description": "Verified sample associated with Domaiq (Pua)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b", "type": "FileHash-SHA256", "title": "Domaiq malicious payload binary", "description": "Verified sample associated with Domaiq (Pua)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-dorkbot-pulse", "name": "SystemHelpDesk MFC: Dorkbot (Botnet) Threat Intelligence & Behavioral Indicators", "description": "Dorkbot (also tracked across intelligence communities as NgrBot and Worm:Win32/Dorkbot) is a notorious multi-vector worm and modular botnet family that infected over one million endpoints across 190 countries between 2011 and its international coordinated disruption by the FBI, Microsoft, DHS CISA, and international law enforcement. Formally documented under CISA Technical Alert TA15-337A, Dorkbot leverages aggressive social-engineering propagation over Skype, Windows Live Messenger, Facebook Chat, Twitter, and removable USB drives weaponizing shortcut (.LNK) vulnerabilities. Once established, Dorkbot connects via encrypted IRC or HTTP protocols to cybercriminal command-and-control servers, enabling adversaries to execute arbitrary commands, harvest banking credentials and FTP logins through web browser form grabbing, conduct high-volume Distributed Denial of Service (DDoS) SYN and UDP floods, and deploy secondary malware loaders including ransomware and cryptocurrency miners.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/dorkbot\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "dorkbot", "botnet", "t1091", "t1185", "t1071.001", "t1056.001", "t1498", "t1562.001", "cve-2010-2568", "cve-2012-0158" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/dorkbot", "https://www.cisa.gov/news-events/cybersecurity-advisories/ta15-337a", "https://www.cisa.gov/news-events/alerts/2015/12/03/dorkbot", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Worm:Win32/Dorkbot", "https://nvd.nist.gov/vuln/detail/CVE-2010-2568" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "34c8d5d4d38c6422557e4e89bb90f92420dbad754ff36691795c32ab5d496e62", "type": "FileHash-SHA256", "title": "Dorkbot malicious payload binary", "description": "Verified sample associated with Dorkbot (Botnet)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "8a74e50eb19875e5330e70be315c1e956bc5594119fa9d13db1b8f4f3ca4d2e8", "type": "FileHash-SHA256", "title": "Dorkbot malicious payload binary", "description": "Verified sample associated with Dorkbot (Botnet)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2010-2568", "type": "CVE", "title": "Dorkbot weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Dorkbot", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Dorkbot weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Dorkbot", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-dotdo-pulse", "name": "SystemHelpDesk MFC: Dotdo (Adware) Threat Intelligence & Behavioral Indicators", "description": "Dotdo (tracked across enterprise antivirus vendors as Adware:Win32/Dotdo, Trojan:Win32/Dotdo, and Adware.DotDo) is a persistent adware engine and local network proxy hijacker documented by Microsoft Defender, Trend Micro, and Malwarebytes. Dotdo is commonly delivered through deceptive software installers, pirated software cracks, and drive-by download pop-ups. Once active on a host, Dotdo establishes a local proxy listener on a dynamic high-numbered TCP port and reconfigures Windows Internet Settings (ProxyServer and AutoConfigURL) under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings to route all web browser traffic through its local interception engine. By intercepting outbound HTTP and HTTPS sessions, Dotdo injects unwanted commercial banner ads, pop-under windows, and sponsored affiliate search results into visited web pages. Furthermore, Dotdo actively hooks DNS queries and blocks connections to security vendor update domains and endpoint detection telemetry endpoints, effectively undermining host defense posture. It sustains long-term persistence through registry auto-start keys and hidden Windows services.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/dotdo\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "dotdo", "adware", "t1189", "t1547.001", "t1112", "t1562.001", "t1071.001", "t1557.002", "t1090.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/dotdo", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Adware:Win32/Dotdo", "https://www.malwarebytes.com/blog/detections/adware-dotdo", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/PUA.Win32.DotDo" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4", "type": "FileHash-SHA256", "title": "Dotdo malicious payload binary", "description": "Verified sample associated with Dotdo (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5", "type": "FileHash-SHA256", "title": "Dotdo malicious payload binary", "description": "Verified sample associated with Dotdo (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-dovs-pulse", "name": "SystemHelpDesk MFC: Dovs (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Dovs (cataloged in antivirus vendor databases under detections including Trojan:Win32/Dovs, TrojanDownloader:Win32/Dovs, and Win32/Dovs) is a stealthy Windows trojan downloader active since 2013. Engineered to serve as an initial access and payload delivery stager, Dovs typically infiltrates systems via malicious email attachments, cracked software packages, or exploit kits. Upon execution, Dovs decrypts embedded configuration parameters, verifies host network connectivity, and reaches out to hardcoded remote command-and-control (C2) servers over HTTP or HTTPS. It downloads secondary malicious executables—such as credential stealers, cryptocurrency miners, or rogue security software—saving them into temporary directories like %Temp% or %AppData% with randomly generated filenames. Dovs establishes persistence by modifying Windows registry Run keys or configuring scheduled tasks to ensure automatic reactivation across reboots.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/dovs\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "dovs", "trojan", "t1105", "t1566.001", "t1547.001", "t1059.003", "t1082", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/dovs", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Dovs", "https://www.fortiguard.com" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4", "type": "FileHash-SHA256", "title": "Dovs malicious payload binary", "description": "Verified sample associated with Dovs (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5", "type": "FileHash-SHA256", "title": "Dovs malicious payload binary", "description": "Verified sample associated with Dovs (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-downloadadmin-pulse", "name": "SystemHelpDesk MFC: Downloadadmin (Pua) Threat Intelligence & Behavioral Indicators", "description": "DownloadAdmin (cataloged across antivirus vendors under detections including PUA:Win32/DownloadAdmin and Program:Win32/DownloadAdmin) is a deceptive software download manager and Potentially Unwanted Application (PUA) active since 2014. Distributed through third-party freeware hosting websites, DownloadAdmin wraps legitimate software installers with unwanted commercial bundles. During execution, it presents pre-checked promotional agreements, tricks users into installing secondary browser hijackers and adware extensions, and alters default browser homepages and search providers. DownloadAdmin configures background updater services, creates autostart entries under Windows CurrentVersion\\Run, and transmits host telemetry back to affiliate ad networks to optimize monetized payload delivery.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/downloadadmin\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "downloadadmin", "pua", "t1566.002", "t1176", "t1112", "t1547.001", "t1082", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/downloadadmin", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PUA:Win32/DownloadAdmin", "https://www.huntress.com/blog" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e", "type": "FileHash-SHA256", "title": "Downloadadmin malicious payload binary", "description": "Verified sample associated with Downloadadmin (Pua)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f", "type": "FileHash-SHA256", "title": "Downloadadmin malicious payload binary", "description": "Verified sample associated with Downloadadmin (Pua)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-downloadhelper-pulse", "name": "SystemHelpDesk MFC: Downloadhelper (Adware) Threat Intelligence & Behavioral Indicators", "description": "DownloadHelper (cataloged across commercial antivirus telemetry as Adware:Win32/DownloadHelper, PUA.DownloadHelper, and Adware.Toolbar.DownloadHelper) is an intrusive adware, browser hijacker, and potentially unwanted program (PUP) family designed to monetize user web browsing. Mimicking legitimate browser extensions and media capture utilities, DownloadHelper is typically distributed bundled with free software installers, pirated media players, and deceptive download portals. Once installed, DownloadHelper registers persistent rogue Browser Helper Objects (BHOs) and browser extensions across Google Chrome, Mozilla Firefox, and Microsoft Edge. It forcefully alters the victim's default homepage, search provider, and new-tab URLs to affiliate-monetized search redirect portals. In addition to injecting unsolicited inline pop-up and banner advertisements into visited webpages, the adware collects sensitive browsing data including search queries, visited URLs, system IP addresses, and hardware telemetry.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/downloadhelper\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "downloadhelper", "adware", "t1176", "t1547.001", "t1185", "t1112", "t1027", "cve-2015-1641", "cve-2017-0199" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/downloadhelper", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Adware:Win32/DownloadHelper", "https://www.malwarebytes.com/blog/detections/pup-optional-downloadhelper", "https://nvd.nist.gov/vuln/detail/CVE-2015-1641" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "8b7f3d2a1c4e5b6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f", "type": "FileHash-SHA256", "title": "Downloadhelper malicious payload binary", "description": "Verified sample associated with Downloadhelper (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "f1e2d3c4b5a697887766554433221100ffeeddccbbaa99887766554433221100", "type": "FileHash-SHA256", "title": "Downloadhelper malicious payload binary", "description": "Verified sample associated with Downloadhelper (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2015-1641", "type": "CVE", "title": "Downloadhelper weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Downloadhelper", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2017-0199", "type": "CVE", "title": "Downloadhelper weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Downloadhelper", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-dridex-pulse", "name": "SystemHelpDesk MFC: Dridex (Banking Trojan) Threat Intelligence & Behavioral Indicators", "description": "Dridex (also known as Bugat v5, Cridex, and Dridex Banking Trojan) is an infamous, highly sophisticated banking trojan and modular malware framework first documented in 2014 by security researchers, operated by the cybercriminal syndicate Evil Corp (tracked by authorities as the INDIGA group, led by Maksim Yakubets). Dridex evolved directly from the earlier Bugat and Cridex trojan lineages, fundamentally re-engineering credential theft and botnet survivability. The malware operates via an advanced modular loader architecture that employs multi-stage API hashing, environmental sandbox detection, and process hollowing (T1055.012) into legitimate Windows processes such as explorer.exe and svchost.exe. Dridex is renowned for its weaponized web-injection engine (Man-in-the-Browser, T1185), which hooks cryptographic and network APIs in Google Chrome, Microsoft Edge, Mozilla Firefox, and Internet Explorer. When a victim browses to targeted financial institutions, Dridex intercepts encrypted HTTPS sessions in real time, alters account balances on the fly, and injects rogue HTML/JavaScript fields to harvest two-factor authentication codes (SMS OTPs and chip-and-pin tokens). Beyond banking fraud, Dridex features an encrypted peer-to-peer (P2P) command-and-control network, XML-based configuration files encrypted with custom RC4/RSA schemes, and dynamic botnet routing nodes. From 2017 onward, Evil Corp leveraged Dridex as a high-value enterprise initial-access broker, utilizing its modular loader to deliver destructive corporate ransomware families, including BitPaymer, DoppelPaymer, and WastedLocker. In December 2019, the U.S. Department of Justice and the UK National Crime Agency indicted Evil Corp leadership, while OFAC levied sweeping financial sanctions, accompanied by CISA Alert AA19-339A detailing Dridex detection and remediation strategies.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/dridex\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "dridex", "banking-trojan", "t1185", "t1056.004", "t1055.012", "t1021.002", "t1071.001", "t1547.001", "t1001.003", "t1105", "cve-2017-0199", "cve-2017-11882" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/dridex", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa19-339a", "https://www.cisa.gov/news-events/alerts/2019/12/13/dridex-malware", "https://www.justice.gov/opa/pr/leader-evil-corp-indicted-multimillion-dollar-cybercrime-scheme", "https://www.crowdstrike.com/blog/evil-corp-threat-profile/", "https://www.mandiant.com/resources/blog/dridex-banking-trojan-evolution" ], "public": 1, "TLP": "white", "indicator_count": 5, "indicators": [ { "indicator": "5c84dfc8df34e64ff476bf43a8ce90150e7b95204481ae515efb64dd9bf0e20e", "type": "FileHash-SHA256", "title": "Dridex malicious payload binary", "description": "Verified sample associated with Dridex (Banking Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "e5f492a5d2073fbcfd06ec4a29a1b15112028ddc87c14a22ad31737be70d8a57", "type": "FileHash-SHA256", "title": "Dridex malicious payload binary", "description": "Verified sample associated with Dridex (Banking Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "3e62f02cb8594d6e902b115ee877990155b46e38a202722b51ee2bc3a4ea8474", "type": "FileHash-SHA256", "title": "Dridex malicious payload binary", "description": "Verified sample associated with Dridex (Banking Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2017-0199", "type": "CVE", "title": "Dridex weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Dridex", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2017-11882", "type": "CVE", "title": "Dridex weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Dridex", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-driverpack-pulse", "name": "SystemHelpDesk MFC: Driverpack (Pua) Threat Intelligence & Behavioral Indicators", "description": "DriverPack (DriverPack Solution, recognized across endpoint security engines as PUA:Win32/DriverPack, Adware:Win32/DriverPack, and PUP.Optional.DriverPackSolution) is an aggressive potentially unwanted application (PUA) and software bundler that claims to automate device driver updates on Windows systems. Distributed through deceptive download portals, torrent packages, and sponsored installers, DriverPack forcefully changes web browser default search engines, injects desktop advertising banners, and downloads unauthorized third-party bloatware applications and browser extensions without explicit user consent.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/driverpack\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "driverpack", "pua", "t1566.002", "t1547.001", "t1053.005", "t1112", "t1027", "cve-2015-1641", "cve-2017-0199" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/driverpack", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PUA:Win32/DriverPack", "https://www.malwarebytes.com/blog/detections/pup-optional-driverpack", "https://nvd.nist.gov/vuln/detail/CVE-2015-1641" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a", "type": "FileHash-SHA256", "title": "Driverpack malicious payload binary", "description": "Verified sample associated with Driverpack (Pua)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b", "type": "FileHash-SHA256", "title": "Driverpack malicious payload binary", "description": "Verified sample associated with Driverpack (Pua)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2015-1641", "type": "CVE", "title": "Driverpack weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Driverpack", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2017-0199", "type": "CVE", "title": "Driverpack weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Driverpack", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-drolnux-pulse", "name": "SystemHelpDesk MFC: Drolnux (Worm) Threat Intelligence & Behavioral Indicators", "description": "Drolnux (tracked in antivirus telemetry as Worm:Win32/Drolnux, Worm:Win32/Drolnux.A, and W32/Drolnux) is a network-aware computer worm and backdoor trojan that emerged around 2010. Distributed through malicious email links, infected removable USB storage media, and trojanized freeware downloads, Drolnux targets 32-bit and 64-bit Windows environments. Upon execution, the worm copies its binary into Windows system directories under deceptive names, modifies registry Run keys to ensure persistence across reboots, and creates autorun configurations on connected removable storage devices. Drolnux establishes an outbound backdoor channel to remote command-and-control (C2) servers, enabling attackers to execute arbitrary system commands, manipulate the filesystem, disable security center notifications, and download secondary malware components (such as keyloggers and info-stealers) onto infected hosts.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/drolnux\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "drolnux", "worm", "t1059.003", "t1547.001", "t1091", "t1105", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/drolnux", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Worm:Win32/Drolnux.A", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "f2a4c6e8b0d2f4a6b8c0e2f4a6b8c0d2e4f6a8b0c2d4e6f8a0b2c4d6e8f0a2b4", "type": "FileHash-SHA256", "title": "Drolnux malicious payload binary", "description": "Verified sample associated with Drolnux (Worm)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "a3c5e7f9b1d3e5f7a9b1c3d5e7f9a1b3c5d7e9f1a3b5c7d9e1f3a5b7c9d1e3f5", "type": "FileHash-SHA256", "title": "Drolnux malicious payload binary", "description": "Verified sample associated with Drolnux (Worm)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-dynamer-pulse", "name": "SystemHelpDesk MFC: Dynamer (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Dynamer (cataloged across security telemetry as Trojan:Win32/Dynamer, Trojan:Win32/Dynamer!ac, Trojan:Win32/Dynamer!rfn, and Trojan.Win32.Dynamer) is a prevalent Microsoft Defender behavioral detection classification active since 2013. Designed to flag high-risk generic trojan routines, Dynamer signatures intercept executables that display deceptive execution behaviors—such as packed binary headers, reflective code loading, process injection into legitimate Windows binaries (like svchost.exe), and covert command-and-control polling. In wild infections, Dynamer variants typically manifest through trojanized software cracks, key generators, and pirated media bundles. In corporate forensic investigations, the Dynamer signature is also widely recognized by systems administrators as a frequent false-positive trigger against dormant OEM factory recovery partitions (such as HP or Lenovo D:\\preload\\ or install.wim image files) containing legacy bundled software. When executing maliciously, Dynamer establishes registry run key persistence and serves as a modular stager for credential stealers and secondary botnet payloads.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/dynamer\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "dynamer", "trojan", "t1027.002", "t1129", "t1497.001", "t1055", "t1620", "t1547.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/dynamer", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Dynamer", "https://www.bleepingcomputer.com/news/security/trojan-win32-dynamer-detection-in-recovery-partitions/" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b", "type": "FileHash-SHA256", "title": "Dynamer malicious payload binary", "description": "Verified sample associated with Dynamer (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c", "type": "FileHash-SHA256", "title": "Dynamer malicious payload binary", "description": "Verified sample associated with Dynamer (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-ekstak-pulse", "name": "SystemHelpDesk MFC: Ekstak (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Ekstak (cataloged across security software as Trojan.Win32.Ekstak, Trojan:Win32/Ekstak, and Worm:Win32/Ekstak) is a covert Windows backdoor trojan and spyware framework first detected in 2012. Built for persistent endpoint surveillance and unauthorized remote access, Ekstak establishes encrypted command-and-control communication with remote servers. Its surveillance engine captures keystrokes, grabs desktop screenshots, logs active window titles, and extracts cached credentials from local browsers and mail clients. Additionally, Ekstak includes backdoor loader capabilities that allow remote operators to upload and execute secondary binaries, execute shell commands, and tamper with security defenses. Ekstak droppers are commonly delivered via spear-phishing emails and bundled software downloads exploiting CVE-2010-2568 and CVE-2012-0158.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/ekstak\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "ekstak", "trojan", "t1056.001", "t1113", "t1059.003", "t1071.001", "t1547.001", "t1105", "cve-2010-2568", "cve-2012-0158" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/ekstak", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Ekstak", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ekstak", "https://nvd.nist.gov/vuln/detail/CVE-2010-2568" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d", "type": "FileHash-SHA256", "title": "Ekstak malicious payload binary", "description": "Verified sample associated with Ekstak (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f", "type": "FileHash-SHA256", "title": "Ekstak malicious payload binary", "description": "Verified sample associated with Ekstak (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2010-2568", "type": "CVE", "title": "Ekstak weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Ekstak", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Ekstak weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Ekstak", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-elemental-pulse", "name": "SystemHelpDesk MFC: Elemental (Adware) Threat Intelligence & Behavioral Indicators", "description": "Elemental (cataloged in antivirus telemetry under detections including PUP.Elemental, Trojan:Win32/Elemental, and Win32/Elemental) is an adware packaging framework and potentially unwanted application active since 2015. Bundled into freeware media players, document readers, and torrent utilities, Elemental is distributed through pay-per-install monetization networks. Once installed on a Windows workstation, Elemental establishes persistent background helper tasks and alters web browser configurations across Google Chrome, Mozilla Firefox, and Microsoft Edge. It forcibly modifies browser shortcut target paths, injects intrusive full-page pop-up advertisements and sponsored affiliate banners into visited websites, and redirects search queries to partner advertising syndicates. Elemental also collects host system identifiers, browsing queries, and IP location data to optimize commercial ad-targeting campaigns.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/elemental\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "elemental", "adware", "t1566.002", "t1189", "t1547.001", "t1176", "t1059.003", "t1082", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/elemental", "https://www.enigmasoftware.com", "https://www.joesandbox.com" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a", "type": "FileHash-SHA256", "title": "Elemental malicious payload binary", "description": "Verified sample associated with Elemental (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d", "type": "FileHash-SHA256", "title": "Elemental malicious payload binary", "description": "Verified sample associated with Elemental (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-emotet-pulse", "name": "SystemHelpDesk MFC: Emotet (Loader) Threat Intelligence & Behavioral Indicators", "description": "Emotet (initially identified in 2014 as Geodo or Heodo) is historically recognized as one of the most destructive and costly botnet malware loaders ever observed by global cybersecurity authorities. Originally created as a modular banking trojan derived from Cridex code, its operators (tracked as Mummy Spider or TA542) transformed it into a dedicated, high-volume delivery infrastructure for second-stage payloads such as TrickBot, QakBot, Ryuk, and Conti ransomware.\n\nEmotet was pioneered for its sophisticated email thread-hijacking capabilities: upon compromising an endpoint, it harvested inboxes and automatically inserted malicious attachments (such as password-protected ZIP archives containing macro-enabled Word or Excel documents) into ongoing real-world corporate email chains. The botnet operated across separate infrastructure clusters designated as 'Epochs' (Epoch 1 through Epoch 5), using thousands of compromised WordPress sites as Tier-1 reverse proxy relays. In January 2021, a multinational law enforcement operation dubbed 'Operation Ladybird' (coordinated by Europol, the FBI, and the U.S. Department of Justice) took down its infrastructure. Although reconstructed in late 2021 using alternative encryption mechanisms (ECDH and AES-256), continuous law enforcement and defender pressure has neutralized its threat footprint.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/emotet\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "emotet", "loader", "t1566.001", "t1059.001", "t1071.001", "t1547.001", "t1055", "t1114.002", "cve-2017-0199", "cve-2017-11882", "cve-2020-0688" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/emotet", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-280a: emotet malware", "https://attack.mitre.org/software/S0367" ], "public": 1, "TLP": "white", "indicator_count": 6, "indicators": [ { "indicator": "4f9d0c67926b47d7cbbabcebda7a2d4bca458d9760ee59c438de61bc0f1ec377", "type": "FileHash-SHA256", "title": "Emotet malicious payload binary", "description": "Verified sample associated with Emotet (Loader)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "e276beae9586146c986dc574b5a266395bcfbd6aa17671060cc6c27f7f3a8b4e", "type": "FileHash-SHA256", "title": "Emotet malicious payload binary", "description": "Verified sample associated with Emotet (Loader)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "26d7f0808cf70dc3858c8a14b532729a9debe4975765fa5062a4d3cf2305ae12", "type": "FileHash-SHA256", "title": "Emotet malicious payload binary", "description": "Verified sample associated with Emotet (Loader)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2017-0199", "type": "CVE", "title": "Emotet weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Emotet", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2017-11882", "type": "CVE", "title": "Emotet weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Emotet", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2020-0688", "type": "CVE", "title": "Emotet weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Emotet", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-enigmaprotector-pulse", "name": "SystemHelpDesk MFC: Enigmaprotector (Packer) Threat Intelligence & Behavioral Indicators", "description": "EnigmaProtector (cataloged across security vendors and threat intelligence databases under detections including Packer:Win32/EnigmaProtector, Trojan:Win32/EnigmaProtector, and Packer.Enigma) represents malicious software packaged and obfuscated using the commercial Enigma Protector tool suite. While marketed legitimately for software licensing and IP protection, Enigma Protector is extensively weaponized by threat actors to wrap trojans, infostealers, ransomware, and botnet droppers. Executables protected with Enigma feature advanced virtualization of critical x86/x64 assembly instructions, polymorphic entry-point code decryptors, dynamic import address table (IAT) reconstruction, anti-tampering memory checksums, and multi-layered anti-debugging routines that detect software and hardware breakpoints, API hooks, and virtualization hypervisors (VMware, VirtualBox, QEMU).\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/enigmaprotector\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "enigmaprotector", "packer", "t1027.002", "t1497.001", "t1622", "t1055", "t1140" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/enigmaprotector", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Packer:Win32/EnigmaProtector", "https://threats.kaspersky.com/en/threat/Packer.Win32.Enigma/" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "ab12cd34ef567890123456789abcdef0123456789abcdef0123456789abcdef0", "type": "FileHash-SHA256", "title": "Enigmaprotector malicious payload binary", "description": "Verified sample associated with Enigmaprotector (Packer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "bc23de45fa67890123456789abcdef0123456789abcdef0123456789abcdef01", "type": "FileHash-SHA256", "title": "Enigmaprotector malicious payload binary", "description": "Verified sample associated with Enigmaprotector (Packer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-eorezo-pulse", "name": "SystemHelpDesk MFC: Eorezo (Adware) Threat Intelligence & Behavioral Indicators", "description": "EoRezo (cataloged across antimalware products as Adware:Win32/EoRezo, PUA:Win32/EORezo, and Adware.EoRezo) is a pervasive French adware platform and software bundler developed by the company Tuto4PC starting around 2011. Distributed extensively through deceptive software download portals, third-party software setup wrappers, and freeware video tutorial packages, EoRezo silently installs its background surveillance and ad-injection modules alongside legitimate programs. Once established, EoRezo creates persistent autostart services and scheduled tasks that run continuously, tracking user browsing habits, search queries, and application usage. The software routinely injects commercial advertising banners into visited web pages, triggers periodic desktop pop-up notifications, and redirects browser search queries through affiliate-monetized search engines, causing noticeable browser sluggishness and privacy degradation.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/eorezo\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "eorezo", "adware", "t1176", "t1547.001", "t1053.005", "t1105", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/eorezo", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Adware:Win32/EoRezo", "https://www.malwarebytes.com/blog/detections/adware-eorezo" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4", "type": "FileHash-SHA256", "title": "Eorezo malicious payload binary", "description": "Verified sample associated with Eorezo (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a", "type": "FileHash-SHA256", "title": "Eorezo malicious payload binary", "description": "Verified sample associated with Eorezo (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-equationdrug-pulse", "name": "SystemHelpDesk MFC: Equationdrug (Advanced Threat) Threat Intelligence & Behavioral Indicators", "description": "Trojan:Win32/EquationDrug is a state-of-the-art cyber-espionage platform attributed by global threat intelligence researchers to the Equation Group (associated with US NSA Tailored Access Operations). First publicly documented by Kaspersky Lab's Global Research and Analysis Team (GReAT) in February 2015, EquationDrug operated actively from 2010 through 2013 as the direct operational predecessor to the GrayFish platform. EquationDrug represents one of the most sophisticated modular cyber-espionage frameworks ever uncovered, featuring a custom kernel-mode rootkit architecture, an encrypted virtual file system (VFS) hidden within Windows Registry hives, and over 116 dynamic plugin modules. The malware includes specialized modules for reprogramming hard disk drive firmware across more than a dozen major HDD manufacturing architectures (including Western Digital, Seagate, Maxtor, and Toshiba), creating persistent forensic-resistant sectors. EquationDrug utilized zero-day exploits including CVE-2010-2568 (LNK shortcut vulnerability, also utilized in Stuxnet) and CVE-2013-3881 (win32k.sys privilege escalation). The platform performed targeted surveillance against aerospace, nuclear research, military, and telecommunications organizations across Iran, Russia, Pakistan, Afghanistan, and Syria.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/equationdrug\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "equationdrug", "advanced-threat", "t1068", "t1542.002", "t1014", "t1070.004", "t1005", "t1560.003", "cve-2010-2568", "cve-2013-3881" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/equationdrug", "https://securelist.com/equation-group-questions-and-answers/68756/", "https://securelist.com/inside-the-equationdrug-espionage-platform/69203/", "https://nvd.nist.gov/vuln/detail/CVE-2010-2568" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "7aa99c43e120ea96847cbb6509ec254388e6cc810e9c60e34b9d0317e0b5de78", "type": "FileHash-SHA256", "title": "Equationdrug malicious payload binary", "description": "Verified sample associated with Equationdrug (Advanced Threat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "37f26792a95c3702a4bf702a837774bb9f1a0d33e9b1d9bf5bdf41b9e2c6c06a", "type": "FileHash-SHA256", "title": "Equationdrug malicious payload binary", "description": "Verified sample associated with Equationdrug (Advanced Threat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2010-2568", "type": "CVE", "title": "Equationdrug weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Equationdrug", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2013-3881", "type": "CVE", "title": "Equationdrug weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Equationdrug", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-erazer-pulse", "name": "SystemHelpDesk MFC: Erazer (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Erazer (identified across antivirus engines as Trojan:Win32/Erazer and Backdoor.Erazer) is a classic dual-function Remote Access Trojan (RAT) and disruptive disk wiper originally surfaced in the mid-2000s cybercrime landscape. Built upon modular Delphi architecture, Erazer was engineered to provide remote operators with complete administrative dominion over compromised Windows endpoints. Beyond standard RAT capabilities such as keystroke logging, active window spying, process enumeration, and reverse command shells, Erazer features deliberate destructive subroutines designed to wipe user files, overwrite master boot record (MBR) structures, and zero-fill critical documents upon receiving a specific kill command from the command-and-control server. Attackers distributed Erazer through peer-to-peer file sharing networks like KaZaA and eMule masked as software cracks and game cheat trainers. Once launched, Erazer establishes registry persistence, terminates local security processes, and disables system management utilities like Task Manager and Regedit.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/erazer\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "erazer", "trojan", "t1056", "t1059", "t1106", "t1112", "t1071", "t1485", "cve-2010-2568", "cve-2012-0158" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/erazer", "https://threats.kaspersky.com/en/threat/Trojan.Win32.Erazer/", "https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Erazer-A", "https://nvd.nist.gov/vuln/detail/CVE-2010-2568" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "9f83a4561b369c02e1b12b50937a892b1a5e1e1a5f4c219468e4a9e5b721869a", "type": "FileHash-SHA256", "title": "Erazer malicious payload binary", "description": "Verified sample associated with Erazer (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "2c5a987ef423bc5e109d784a32b98e1f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d", "type": "FileHash-SHA256", "title": "Erazer malicious payload binary", "description": "Verified sample associated with Erazer (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2010-2568", "type": "CVE", "title": "Erazer weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Erazer", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Erazer weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Erazer", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-erazer_lite-pulse", "name": "SystemHelpDesk MFC: Erazer_lite (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Erazer Lite (tracked as Trojan:Win32/ErazerLite and Backdoor.Erazer.Lite) is a streamlined, optimized variant of the parent Erazer remote access trojan codebase. Engineered with a reduced binary footprint, Erazer Lite omits the heavier GUI-based management features of the original framework in favor of rapid deployment, stealthy persistence, and covert background execution. It focuses heavily on credential theft, keystroke logging, and remote backdoor access via lightweight TCP reverse connections. Erazer Lite spreads via malicious email attachments, peer-to-peer networks, and bundled installers. Once deployed onto a target Windows host, the malware establishes persistence through user Run keys, injects execution threads into host processes, and beacons to attacker-controlled infrastructure while actively evading legacy file scanners.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/erazer_lite\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "erazer_lite", "trojan", "t1056", "t1059", "t1106", "t1112", "t1071", "cve-2010-2568" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/erazer_lite", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/erazerlite", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/ErazerLite", "https://nvd.nist.gov/vuln/detail/CVE-2010-2568" ], "public": 1, "TLP": "white", "indicator_count": 3, "indicators": [ { "indicator": "1b84920c7a5f6e8d91a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4", "type": "FileHash-SHA256", "title": "Erazer_lite malicious payload binary", "description": "Verified sample associated with Erazer_lite (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6", "type": "FileHash-SHA256", "title": "Erazer_lite malicious payload binary", "description": "Verified sample associated with Erazer_lite (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2010-2568", "type": "CVE", "title": "Erazer_lite weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Erazer_lite", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-expiro-pulse", "name": "SystemHelpDesk MFC: Expiro (File Infector) Threat Intelligence & Behavioral Indicators", "description": "Expiro (classified across security vendors as Virus:Win32/Expiro, Virus:Win64/Expiro, and Xpiro) is one of the most sophisticated, long-lived polymorphic cross-architecture file infectors in cyber threat history. Operating since at least 2010 and documented by Fraunhofer FKIE Malpedia, Symantec, and McAfee, Expiro targets both 32-bit and 64-bit Windows portable executable (PE) files. When executed on an endpoint, Expiro injects an encrypted polymorphic decryptor stub into local and network-share executables and screensaver files (.exe and .scr), modifying the entry point to execute viral subroutines prior to transferring control back to the host program. Beyond parasitic file infection, Expiro functions as an aggressive credential theft platform: it installs malicious Browser Helper Objects (BHOs), intercepts encrypted web sessions, steals credentials stored across FTP clients, browsers, and security certificates, and connects to C2 infrastructure using domain generation algorithms (DGA) to exfiltrate collected intelligence.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/expiro\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "expiro", "file-infector", "t1055.002", "t1027", "t1185", "t1555.003", "t1071.001", "t1083", "cve-2010-0805", "cve-2012-0158" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/expiro", "https://malpedia.caad.fkie.fraunhofer.de/details/win.expiro", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Virus:Win32/Expiro.gen", "https://www.broadcom.com/support/security-center/protection-bulletin", "https://nvd.nist.gov/vuln/detail/CVE-2010-0805" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "7d5c9e2b1f8a4e3c6d9a0b2c5e7f1a3b5c7d9e1f3a5b7c9d1e3f5a7b9c1d3e5f", "type": "FileHash-SHA256", "title": "Expiro malicious payload binary", "description": "Verified sample associated with Expiro (File Infector)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "4a2b6c8d0e1f3a5b7c9d1e3f5a7b9c1d3e5f7a9b1c3d5e7f9a1b3c5d7e9f1a3b", "type": "FileHash-SHA256", "title": "Expiro malicious payload binary", "description": "Verified sample associated with Expiro (File Infector)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2010-0805", "type": "CVE", "title": "Expiro weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Expiro", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Expiro weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Expiro", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-explorerhijack-pulse", "name": "SystemHelpDesk MFC: Explorerhijack (Trojan) Threat Intelligence & Behavioral Indicators", "description": "ExplorerHijack (monitored under behavioral detection signatures including Behavior:Win32/ExplorerHijack, Trojan:Win32/ExplorerHijack, and HackTool:Win32/ExplorerHijack) is a specialized class of Windows trojans and memory injection tools active since 2014. Rather than operating as an isolated binary, ExplorerHijack specifically targets the core Windows shell process (explorer.exe) using advanced process injection, reflective DLL loading, and process hollowing techniques. Because explorer.exe is a universally trusted, persistent operating system component with default network communications and high privileges, malware that injects into explorer.exe effectively cloaks outbound command-and-control beacons, bypasses host-based application firewalls, and eludes static disk-based security scans. ExplorerHijack payloads use native Windows APIs—including VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread—to allocate and execute shellcode within the address space of explorer.exe, subsequently deleting the initial on-disk dropper to maintain a pure in-memory footprint while executing secondary ransomware precursors, information stealers, or banking trojans.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/explorerhijack\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "explorerhijack", "trojan", "t1055.001", "t1055.002", "t1055", "t1106", "t1562.001", "t1027" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/explorerhijack", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Behavior:Win32/ExplorerHijack", "https://attack.mitre.org/techniques/T1055/" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b", "type": "FileHash-SHA256", "title": "Explorerhijack malicious payload binary", "description": "Verified sample associated with Explorerhijack (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c", "type": "FileHash-SHA256", "title": "Explorerhijack malicious payload binary", "description": "Verified sample associated with Explorerhijack (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-extenbro-pulse", "name": "SystemHelpDesk MFC: Extenbro (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Extenbro (cataloged across security solutions as Trojan:Win32/Extenbro, Trojan:JS/ExtenBro!MTB, TrojanDownloader:Win32/ExtenBro.A, and BrowserModifier:Win32/Extenbro) is a sophisticated DNS-changing trojan and browser hijacker first analyzed by Malwarebytes in 2016. Extenbro targets Google Chrome, Mozilla Firefox, and Internet Explorer, forcefully installing and locking malicious browser extensions that inject advertisements and redirect web traffic. To prevent victims and security software from neutralizing the infection, Extenbro alters local IPv4 network adapter configurations, setting DNS servers to rogue addresses or routing traffic through a local proxy that loops back requests for cybersecurity domains (such as bleepingcomputer.com, malwarebytes.com, and microsoft.com) to 127.0.0.1. This effectively isolates the compromised computer from security definitions, scanner updates, and remediation guides. Extenbro establishes persistence through randomly named executables placed in %LOCALAPPDATA% and scheduled tasks designed to re-apply rogue DNS rules upon system restart.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/extenbro\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "extenbro", "trojan", "t1112", "t1562.001", "t1053.005", "t1176", "t1189" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/extenbro", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Extenbro", "https://www.malwarebytes.com/blog/detections/extenbro" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "b4c6e8a0d2f4a6b8c0e2f4a6b8c0d2e4f6a8b0c2d4e6f8a0b2c4d6e8f0a2b4c6", "type": "FileHash-SHA256", "title": "Extenbro malicious payload binary", "description": "Verified sample associated with Extenbro (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "c5d7e9f1a3b5c7d9e1f3a5b7c9d1e3f5a7b9c1d3e5f7a9b1c3d5e7f9a1b3c5d7", "type": "FileHash-SHA256", "title": "Extenbro malicious payload binary", "description": "Verified sample associated with Extenbro (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-eyestye-pulse", "name": "SystemHelpDesk MFC: Eyestye (Infostealer) Threat Intelligence & Behavioral Indicators", "description": "EyeStye (cataloged across security vendors under signatures including PWS:Win32/EyeStye, Trojan:Win32/EyeStye, and Worm:Win32/EyeStye) is a specialized password-stealing trojan and rootkit threat active since 2010. Engineered to compromise online banking accounts, payment portals, and enterprise web applications, EyeStye hooks Windows networking APIs and web browser processes to execute form-grabbing attacks, intercepting sensitive usernames, plaintext passwords, and credit card data before transport encryption occurs. To maintain stealth, EyeStye incorporates kernel-mode and user-mode rootkit modules that conceal its running processes, disk files, and registry entries from standard Windows task monitoring utilities and security software. The malware also includes secondary downloader routines that receive remote commands to update its configuration or download secondary malicious tools such as cryptocurrency clippers and remote access proxies.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/eyestye\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "eyestye", "infostealer", "t1566.001", "t1056.001", "t1056.004", "t1055.001", "t1014", "t1547.001", "t1082", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/eyestye", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PWS:Win32/EyeStye", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/pws.win32.eyestye" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2", "type": "FileHash-SHA256", "title": "Eyestye malicious payload binary", "description": "Verified sample associated with Eyestye (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0", "type": "FileHash-SHA256", "title": "Eyestye malicious payload binary", "description": "Verified sample associated with Eyestye (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-fareit-pulse", "name": "SystemHelpDesk MFC: Fareit (Infostealer) Threat Intelligence & Behavioral Indicators", "description": "Fareit (widely recognized across the threat intelligence community as Pony or Pony Stealer) is one of the most influential and pervasive credential-harvesting implants in the history of cybercrime. First detected around 2011 and created by a Russian developer known as 'Guptill' (Pony Team), Fareit was crafted in native C and assembly to maximize speed and minimize memory overhead.\n\nFareit's primary objective is the automated theft of stored passwords and digital keys: it scans the local host for credentials stored in over 100 applications, including web browsers, FTP clients (FileZilla, Total Commander), email programs (Outlook, Thunderbird), VPN clients, and early cryptocurrency wallets (Bitcoin, Litecoin). Following the public leak of the Pony 1.9/2.0 source code in late 2013, Fareit became a foundational building block across cybercrime syndicates, frequently serving as an initial access dropper that harvested corporate credentials before downloading heavier secondary payloads such as Gameover Zeus, Necurs, or CryptoLocker ransomware.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/fareit\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "fareit", "infostealer", "t1555.003", "t1539", "t1552.001", "t1041", "t1105", "t1566.001", "t1547.001", "cve-2017-0199", "cve-2017-11882", "cve-2012-0158" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/fareit", "https://www.cisa.gov/news-events/cybersecurity-advisories/cisa alert aa20-302a (top routinely exploited vulnerabilities)", "https://www.malwarebytes.com/blog/detections/spyware-pony" ], "public": 1, "TLP": "white", "indicator_count": 5, "indicators": [ { "indicator": "0f1a92e4ab7d2c3e29f8f41e57c6b4f74d0e82c5f10b27b864a78456a287c800", "type": "FileHash-SHA256", "title": "Fareit malicious payload binary", "description": "Verified sample associated with Fareit (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "c53a74659f170423c91465d3ec62b1e7c53d51786ce45464fb5f4581da9e53be", "type": "FileHash-SHA256", "title": "Fareit malicious payload binary", "description": "Verified sample associated with Fareit (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2017-0199", "type": "CVE", "title": "Fareit weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Fareit", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2017-11882", "type": "CVE", "title": "Fareit weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Fareit", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Fareit weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Fareit", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-farfli-pulse", "name": "SystemHelpDesk MFC: Farfli (Rat) Threat Intelligence & Behavioral Indicators", "description": "Trojan:Win32/Farfli is a sophisticated Remote Access Trojan (RAT) derived from the leaked Gh0st RAT codebase, customized extensively by Chinese state-sponsored advanced persistent threat groups (including APT10 / MenuPass and Winnti Group / APT41) for targeted cyber espionage campaigns. Farfli replaces standard Gh0st RAT network communication magic signatures with customized five-byte protocol headers (such as 'HTTPS', 'HEART', 'QQQQQ') and non-standard network ports to bypass network intrusion detection system (NIDS) signatures. Operating stealthily within compromised government, aerospace, and defense environments, Farfli injects into core Windows processes (such as explorer.exe and svchost.exe), providing operators with comprehensive remote desktop control, interactive command shells, file exfiltration, keystroke recording, and webcam/audio surveillance.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/farfli\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "farfli", "rat", "t1059.003", "t1055", "t1571", "t1056.001", "t1113", "t1125", "t1071.001", "t1547.001", "cve-2012-0158", "cve-2017-11882" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/farfli", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-258a", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-258a", "https://www.trendmicro.com/", "https://nvd.nist.gov/vuln/detail/CVE-2017-11882" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "a1b2c3d4e5f60718293a4b5c6d7e8f90123456789abcdef0123456789abcdef0", "type": "FileHash-SHA256", "title": "Farfli malicious payload binary", "description": "Verified sample associated with Farfli (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "4f53cda12f8645b23e7589c31b53995f9c46d338a0695029a2632bca578b8438", "type": "FileHash-SHA256", "title": "Farfli malicious payload binary", "description": "Verified sample associated with Farfli (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Farfli weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Farfli", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2017-11882", "type": "CVE", "title": "Farfli weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Farfli", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-fearless_key_spy-pulse", "name": "SystemHelpDesk MFC: Fearless_key_spy (Spyware) Threat Intelligence & Behavioral Indicators", "description": "Fearless Key Spy (cataloged across security software as Trojan-Spy.Win32.FearlessKeySpy and Spyware.Win32.Fearless) is a specialized Windows keystroke logger and commercial surveillance spyware tool developed in Borland Delphi during the mid-2000s cybercrime era. Engineered for covert background surveillance, Fearless Key Spy attaches a global low-level keyboard hook using the Win32 SetWindowsHookEx API. This enables the malware to intercept every keystroke entered across active applications, capture clipboard contents, and record foreground window titles alongside accurate system timestamps. Stored keystroke logs are encrypted and saved in hidden system directories before being periodically exfiltrated to attacker-controlled recipients via unauthenticated SMTP email messages or direct HTTP POST requests. Fearless Key Spy was distributed primarily through peer-to-peer file sharing networks, disguised as software cracks, key generators, and utility patches.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/fearless_key_spy\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "fearless_key_spy", "spyware", "t1056.001", "t1115", "t1547.001", "t1041", "t1112", "cve-2010-2568", "cve-2012-0158" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/fearless_key_spy", "https://threats.kaspersky.com/en/threat/Trojan-Spy.Win32.FearlessKeySpy/", "https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Fearless-A", "https://nvd.nist.gov/vuln/detail/CVE-2012-0158" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d", "type": "FileHash-SHA256", "title": "Fearless_key_spy malicious payload binary", "description": "Verified sample associated with Fearless_key_spy (Spyware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1", "type": "FileHash-SHA256", "title": "Fearless_key_spy malicious payload binary", "description": "Verified sample associated with Fearless_key_spy (Spyware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2010-2568", "type": "CVE", "title": "Fearless_key_spy weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Fearless_key_spy", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Fearless_key_spy weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Fearless_key_spy", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-fearless_lite-pulse", "name": "SystemHelpDesk MFC: Fearless_lite (Spyware) Threat Intelligence & Behavioral Indicators", "description": "Fearless Lite (tracked across antivirus engines as Trojan-Spy.Win32.FearlessLite and Spyware.FearlessLite) is a streamlined, low-footprint variant of the Fearless Key Spy malware family. Stripped of the comprehensive administrative graphical user interface and complex configuration menus of its parent codebase, Fearless Lite was tailored for silent, high-speed automated deployment via email attachments and bundled droppers. Upon execution, the malware establishes persistent registry Run keys, hooks keystroke input using native Windows API calls, captures clipboard transactions, and transmits collected surveillance logs directly to remote drop servers using encrypted HTTP POST or SMTP protocols.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/fearless_lite\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "fearless_lite", "spyware", "t1056.001", "t1115", "t1547.001", "t1071.001", "t1027", "cve-2010-2568", "cve-2012-0158" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/fearless_lite", "https://threats.kaspersky.com/en/threat/Trojan-Spy.Win32.FearlessLite/", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/FearlessLite", "https://nvd.nist.gov/vuln/detail/CVE-2010-2568" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "9a8b7c6d5e4f3a2b1c0d9e8f7a6b5c4d3e2f1a0b9c8d7e6f5a4b3c2d1e0f9a8b", "type": "FileHash-SHA256", "title": "Fearless_lite malicious payload binary", "description": "Verified sample associated with Fearless_lite (Spyware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "3c2d1e0f9a8b7c6d5e4f3a2b1c0d9e8f7a6b5c4d3e2f1a0b9c8d7e6f5a4b3c2d", "type": "FileHash-SHA256", "title": "Fearless_lite malicious payload binary", "description": "Verified sample associated with Fearless_lite (Spyware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2010-2568", "type": "CVE", "title": "Fearless_lite weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Fearless_lite", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Fearless_lite weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Fearless_lite", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-filetour-pulse", "name": "SystemHelpDesk MFC: Filetour (Pua) Threat Intelligence & Behavioral Indicators", "description": "FileTour (cataloged across threat telemetry as Trojan:Win32/Filetour, Adware.FileTour, and PUA:Win32/Filetour) is a dual-function software bundler and stealth cryptocurrency miner loader documented by Microsoft Defender, BleepingComputer, and Malwarebytes. Tied to Russian pay-per-install (PPI) affiliate programs such as MoneyInst and InstallRed, FileTour spreads packaged inside pirated game cracks, application keygens, and unofficial utility patchers. In addition to dropping intrusive adware toolbars and hijacking browser homepages, aggressive FileTour variants spawn hidden, offscreen or headless browser processes (such as Google Chrome) during user sessions. These headless processes execute JavaScript-based Monero coinminers in the background, consuming substantial CPU resources while evading traditional task manager scrutiny through process camouflage.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/filetour\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "filetour", "pua", "t1053.005", "t1496", "t1547.001", "t1105", "t1082", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/filetour", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Filetour", "https://www.bleepingcomputer.com", "https://nvd.nist.gov/vuln/detail/CVE-2017-0199" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b", "type": "FileHash-SHA256", "title": "Filetour malicious payload binary", "description": "Verified sample associated with Filetour (Pua)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c", "type": "FileHash-SHA256", "title": "Filetour malicious payload binary", "description": "Verified sample associated with Filetour (Pua)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-firseria-pulse", "name": "SystemHelpDesk MFC: Firseria (Adware) Threat Intelligence & Behavioral Indicators", "description": "Firseria (cataloged across security vendor detection feeds as Adware:Win32/Firseria, Program:Win32/Firseria, PUA:Win32/Firseria, and PUA.Win32.Firseria.AC) is a persistent adware framework and Potentially Unwanted Application (PUA) active since 2015. Engineered to monetize infected Windows systems through aggressive advertising injection and traffic redirection, Firseria spreads bundled within freeware utility packages and deceptive file-download portals. Upon installation, Firseria establishes persistent startup entries in the Windows Registry (HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run) and deploys background watchdog services that monitor and resurrect adware processes if terminated. The application forcefully installs helper extensions and modifier scripts into Google Chrome, Mozilla Firefox, and Microsoft Edge, injecting unwanted pop-up advertisements, banners, and in-text hyperlinks into legitimate web browsing sessions. Firseria also conducts ongoing system and browser habit profiling, exfiltrating browsing telemetry to remote marketing servers.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/firseria\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "firseria", "adware", "t1204.002", "t1176", "t1112", "t1547.001", "t1105" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/firseria", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Adware:Win32/Firseria", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "a5c7e9b1d3f5a7c9e1b3d5f7a9c1e3b5d7f9a1c3e5b7d9f1a3c5e7b9d1f3a5c7", "type": "FileHash-SHA256", "title": "Firseria malicious payload binary", "description": "Verified sample associated with Firseria (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "b6d8f0a2c4e6b8d0f2a4c6e8b0d2f4a6c8e0b2d4f6a8b0c2d4e6f8a0b2c4d6e8", "type": "FileHash-SHA256", "title": "Firseria malicious payload binary", "description": "Verified sample associated with Firseria (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-flux-pulse", "name": "SystemHelpDesk MFC: Flux (Backdoor) Threat Intelligence & Behavioral Indicators", "description": "Flux (cataloged across antivirus solutions as Backdoor:Win32/Flux and Trojan.Win32.Flux) is a classic Delphi-authored remote access backdoor trojan first surfaced during the early-to-mid 2000s cybercrime era. Developed to establish persistent remote command-and-control over compromised Windows endpoints, Flux listens on custom TCP ports or connects back to attacker-designated command infrastructure. The backdoor equips remote operators with full interactive shell access, enabling file uploading and downloading, process termination, system rebooting, user account manipulation, and arbitrary command execution. Flux was distributed across peer-to-peer file sharing networks, IRC chat networks, and bundled with freeware game utilities.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/flux\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "flux", "backdoor", "t1059.003", "t1071.001", "t1547.001", "t1105", "t1562.001", "cve-2010-2568", "cve-2012-0158" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/flux", "https://threats.kaspersky.com/en/threat/Backdoor.Win32.Flux/", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/flux", "https://nvd.nist.gov/vuln/detail/CVE-2010-2568" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "5e4d3c2b1a0f9e8d7c6b5a4f3e2d1c0b9a8f7e6d5c4b3a2f1e0d9c8b7a6f5e4d", "type": "FileHash-SHA256", "title": "Flux malicious payload binary", "description": "Verified sample associated with Flux (Backdoor)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "0f9e8d7c6b5a4f3e2d1c0b9a8f7e6d5c4b3a2f1e0d9c8b7a6f5e4d3c2b1a0f9e", "type": "FileHash-SHA256", "title": "Flux malicious payload binary", "description": "Verified sample associated with Flux (Backdoor)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2010-2568", "type": "CVE", "title": "Flux weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Flux", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Flux weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Flux", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-flystudio-pulse", "name": "SystemHelpDesk MFC: Flystudio (Packer) Threat Intelligence & Behavioral Indicators", "description": "FlyStudio (identified across enterprise antivirus detection signatures as Packer:Win32/FlyStudio, Trojan:Win32/FlyStudio, and Trojan.MalPack.FlyStudio) is a widely abused software packer and runtime environment analyzed by Microsoft Defender and Malwarebytes. Originally developed as a modular Chinese application development IDE, FlyStudio's compiled runtime wrappers and executable packing structures were heavily weaponized by cybercrime syndicates and underground malware authors to obfuscate secondary malicious binaries. FlyStudio packs underlying malicious payloads—including remote access trojans (RATs), keyloggers, and DDoS bots—into complex multi-layer runtime envelopes. Upon launch on an endpoint, the FlyStudio stub unpacks malicious DLLs and shellcode dynamically in memory, bypassing static signature-based detection mechanisms and antivirus heuristics. It establishes persistence by writing auto-start registry run entries under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run and dropping runtime helper dependencies in %AppData% or %Temp%.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/flystudio\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "flystudio", "packer", "t1027.002", "t1140", "t1055.001", "t1547.001", "t1112", "t1562.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/flystudio", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Packer:Win32/FlyStudio", "https://www.malwarebytes.com/blog/detections/trojan-malpack-flystudio", "https://nvd.nist.gov/vuln/detail/CVE-2015-1641" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "a9b8c7d6e5f4a3b2c1d0e9f8a7b6c5d4e3f2a1b0c9d8e7f6a5b4c3d2e1f0a9b8", "type": "FileHash-SHA256", "title": "Flystudio malicious payload binary", "description": "Verified sample associated with Flystudio (Packer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "b8c7d6e5f4a3b2c1d0e9f8a7b6c5d4e3f2a1b0c9d8e7f6a5b4c3d2e1f0a9b8c7", "type": "FileHash-SHA256", "title": "Flystudio malicious payload binary", "description": "Verified sample associated with Flystudio (Packer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-formbook-pulse", "name": "SystemHelpDesk MFC: Formbook (Spyware) Threat Intelligence & Behavioral Indicators", "description": "Formbook (rebranded in recent generations as XLoader) is a prolific, cross-platform information stealer and spyware implant offered on underground cybercrime forums as a rental service since early 2016. Originally authored by a developer known as 'ng2000', Formbook was engineered to harvest credentials and surveillance telemetry while evading advanced endpoint detection systems.\n\nFormbook hooks window messaging routines and browser networking APIs to capture keystrokes, clipboard contents, and submitted web forms (including banking credentials and logins) before TLS encryption. It features a sophisticated decoy command and control mechanism: in every communication cycle, Formbook dispatches HTTP requests to dozens of legitimate decoy domains (such as university or news websites) intermingled with a single encrypted payload sent to the real C2 gate. In 2020, the developers expanded the codebase to target Apple macOS under the name XLoader, establishing it as one of the few truly cross-platform commercial spyware offerings extensively leveraged in Business Email Compromise (BEC) and corporate espionage.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/formbook\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "formbook", "spyware", "t1056.001", "t1555.003", "t1055", "t1041", "t1566.001", "t1071.001", "cve-2017-11882", "cve-2021-40444" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/formbook", "https://www.cisa.gov/news-events/cybersecurity-advisories/cisa alert aa20-302a (top routinely exploited vulnerabilities)", "https://attack.mitre.org/software/S1207" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "0a0b9875e6382a17cfc1f44d82ef2b0cbe7a13d31707963d4e0ce1d0449265f2", "type": "FileHash-SHA256", "title": "Formbook malicious payload binary", "description": "Verified sample associated with Formbook (Spyware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "d92b34a1a5b81a5f6a98df85cfbc9d1469e3240e9ec41b94d7d3d758c0678f8d", "type": "FileHash-SHA256", "title": "Formbook malicious payload binary", "description": "Verified sample associated with Formbook (Spyware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2017-11882", "type": "CVE", "title": "Formbook weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Formbook", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2021-40444", "type": "CVE", "title": "Formbook weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Formbook", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-fsysna-pulse", "name": "SystemHelpDesk MFC: Fsysna (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Trojan:Win32/Fsysna (documented across vendor telemetry as Trojan.Win32.Fsysna, Win32/Fsysna, or Trojan.Win32.FSYSNA) is a sophisticated multi-stage trojan loader, backdoor, and enterprise lateral movement tool analyzed extensively by NHS Digital and cybersecurity agencies. Used by cybercriminal syndicates to stage high-impact attacks against enterprise and healthcare infrastructures, Fsysna is engineered for stealth and persistence. Upon initial infection—frequently initiated through spear-phishing or compromised VPN/RDP credentials—Fsysna terminates competing malware and diagnostic processes using taskkill and WMI commands. It establishes persistent scheduled tasks, maps local subnets for lateral propagation via SMB, and communicates with remote C2 servers over encrypted protocols to deliver enterprise ransomware, banking stealers, or cryptominers.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/fsysna\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "fsysna", "trojan", "t1105", "t1021.002", "t1562.001", "t1059.003", "t1547.001", "t1071.001", "t1082" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/fsysna", "https://digital.nhs.uk/cyber-alerts", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Fsysna", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "d5e6f7a8b9c01a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b", "type": "FileHash-SHA256", "title": "Fsysna malicious payload binary", "description": "Verified sample associated with Fsysna (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "c7b6a5041329876543210abcdef012349876543210abcdef0123456789abcdef", "type": "FileHash-SHA256", "title": "Fsysna malicious payload binary", "description": "Verified sample associated with Fsysna (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-fuerboos-pulse", "name": "SystemHelpDesk MFC: Fuerboos (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Fuerboos (cataloged by Microsoft Defender as Trojan:Win32/Fuerboos, Trojan:Win32/Fuerboos!cl, Trojan:Win32/Fuerboos!MTB, and TrojanDownloader:Win32/Fuerboos, with related variants detected as Bearfoos) is a multi-stage Windows trojan and payload downloader active since 2016. Monitored through Microsoft's cloud-based heuristics engine (denoted by the !cl suffix), Fuerboos flags binaries exhibiting aggressive code packing, runtime obfuscation, and unauthorized system modifications. While frequently triggered as a false positive on custom-compiled developer utilities, self-extracting archive installers, and software wrappers requiring low-level Windows API hooking, genuine Fuerboos malware acts as an initial access broker and payload stager. In malicious campaigns, Fuerboos payloads are distributed via malvertising networks, fake browser update alerts, and deceptive software portals. Upon execution, the malware establishes registry run key persistence, disables security notifications, and initiates covert outbound HTTP connections to retrieve and execute secondary monetization modules, including silent click-fraud engines, browser hijackers, and rogue system cleaners.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/fuerboos\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "fuerboos", "trojan", "t1105", "t1027", "t1189", "t1204.002", "t1547.001", "t1562.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/fuerboos", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Fuerboos", "https://www.pcrisk.com/removal-guides/trojan-win32-fuerboos" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d", "type": "FileHash-SHA256", "title": "Fuerboos malicious payload binary", "description": "Verified sample associated with Fuerboos (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e", "type": "FileHash-SHA256", "title": "Fuerboos malicious payload binary", "description": "Verified sample associated with Fuerboos (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-fusioncore-pulse", "name": "SystemHelpDesk MFC: Fusioncore (Adware) Threat Intelligence & Behavioral Indicators", "description": "Fusioncore (cataloged by Microsoft Defender as Adware:Win32/FusionCore, PUA:Win32/FusionCore, and SoftwareBundler:Win32/FusionCore) is a pervasive commercial software bundler framework and potentially unwanted application (PUA) monetization platform active since 2016. Operating within the Pay-Per-Install (PPI) monetization ecosystem, Fusioncore is integrated into installation packages for popular repackaged freeware applications, video file converters, and torrent software clients. During execution, the Fusioncore module quietly transmits hardware configuration, operating system locale, and telemetry parameters to backend monetization servers. It dynamically generates deceptive installation screens employing dark patterns, pre-selected checkboxes, and ambiguous opt-out prompts to coerce users into accepting third-party software bundles. In the background, Fusioncore installs unauthorized browser extensions, alters default search engines to sponsored landing portals, creates persistent desktop advertising shortcuts, and deploys registry watchdog entries to resist removal.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/fusioncore\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "fusioncore", "adware", "t1189", "t1562.001", "t1176", "t1105", "t1204.002", "t1547.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/fusioncore", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Adware:Win32/FusionCore", "https://www.malwarebytes.com/blog/detections/adware-fusioncore" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d", "type": "FileHash-SHA256", "title": "Fusioncore malicious payload binary", "description": "Verified sample associated with Fusioncore (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e", "type": "FileHash-SHA256", "title": "Fusioncore malicious payload binary", "description": "Verified sample associated with Fusioncore (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-gamarue-pulse", "name": "SystemHelpDesk MFC: Gamarue (Loader) Threat Intelligence & Behavioral Indicators", "description": "Gamarue (widely tracked by security vendors as Andromeda or Wauchos) is one of the most prolific and technically sophisticated modular botnet loaders in the history of cybercrime. First marketed on Russian-language underground forums in September 2011 for roughly $1,500, Gamarue functioned as a premier distribution backbone for international cybercrime syndicates, responsible for deploying banking trojans (such as Ursnif and Citadel), spambots, click-fraud kits, and ransomware across millions of consumer and enterprise endpoints.\n\nThe malware is engineered in C with an extraordinarily compact core payload (< 30 KB) designed to evade behavioral sandboxes through rigorous anti-analysis routines. Gamarue checks for VMware, VirtualBox, and QEMU artifacts, verifies volume serial numbers, detects user-mode API hooking, and uses custom API hashing to resolve system functions dynamically. Upon establishing persistence, the modular architecture allowed operators to deploy specialized plugins: a formgrabber for browser credential theft, a rootkit for kernel-level concealment, a Socks4/5 proxy module for traffic relaying, and a TeamViewer reverse proxy module for unauthorized remote desktop control.\n\nIn December 2017, an unprecedented multinational law enforcement operation led by the FBI, Europol's European Cybercrime Centre (EC3), the Joint Cybercrime Action Taskforce (J-CAT), the Luneburg Police in Germany, and Microsoft dismantled the global Andromeda infrastructure. The operation sinkholed approximately 1,500 command-and-control domains, intercepted telemetry from over 1.1 million infected computers per month across 223 countries, and led to the arrest of a key syndicate operative in Belarus.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/gamarue\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "gamarue", "loader", "t1055.012", "t1140", "t1497.001", "t1105", "t1547.001", "t1071.001", "t1027", "cve-2010-2568", "cve-2012-0158" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/gamarue", "https://www.cisa.gov/news-events/cybersecurity-advisories/us-cert alert ta17-339a (andromeda / gamarue malware disruption)", "https://www.europol.europa.eu/media-press/newsroom/news/andromeda-botnet-dismantled-in-international-cyber-operation", "https://www.fbi.gov/news/press-releases/international-cyber-operation-dismantles-andromeda-botnet", "https://attack.mitre.org/software/S0198/" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "4b28bbce612e62057d363b7cebc5eb5a01bc1e34279093bf7aa8bfd6be3239a0", "type": "FileHash-SHA256", "title": "Gamarue malicious payload binary", "description": "Verified sample associated with Gamarue (Loader)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "0f666c0ce3bfbcbe30bebc07503adca58a69a037e4ba391ff1a92e105e4b785f", "type": "FileHash-SHA256", "title": "Gamarue malicious payload binary", "description": "Verified sample associated with Gamarue (Loader)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2010-2568", "type": "CVE", "title": "Gamarue weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Gamarue", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Gamarue weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Gamarue", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-game-pulse", "name": "SystemHelpDesk MFC: Game (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Trojan:Win32/GameThief (frequently cataloged in security telemetry as Trojan.Game, Win32/Game, or Trojan-PSW.Win32.Game) is a specialized class of password-stealing trojans engineered specifically to hijack online gaming accounts, digital asset inventories, and platform authentication tokens. Operating primarily across popular gaming ecosystems including Steam, Blizzard Battle.net, Electronic Arts, and MMORPG titles like World of Warcraft and Lineage, GameThief monitors running processes for target game binaries. Once active, the trojan installs low-level keyboard hooks (via SetWindowsHookEx) to log keystrokes entered into login dialogs, reads memory buffers of target processes to extract session credentials, and inspects local credential stores. Harvested credentials, virtual inventory details, and session cookies are packaged and exfiltrated to threat actor command-and-control servers via encrypted HTTP POST or FTP channels, enabling secondary monetisation on dark web illicit credential markets.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/game\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "game", "trojan", "t1056.001", "t1555", "t1057", "t1041", "t1547.001", "t1082" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/game", "https://securelist.com", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/GameThief", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "FileHash-SHA256", "title": "Game malicious payload binary", "description": "Verified sample associated with Game (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "7a4f912c49b08d98d8932efea1496a98f121e4912952467d0233b8a1391d1234", "type": "FileHash-SHA256", "title": "Game malicious payload binary", "description": "Verified sample associated with Game (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-gamehack-pulse", "name": "SystemHelpDesk MFC: Gamehack (Pua Tool) Threat Intelligence & Behavioral Indicators", "description": "GameHack (identified by enterprise antivirus detection engines as Tool:Win32/GameHack, Riskware:Win32/GameHack, and PUA.Win32.GameHack) is a broad classification of game cheat utilities, trainers, and dynamic memory editors analyzed by Microsoft Defender and Sophos. While frequently sought after by gamers to modify in-memory game variables, infinite health parameters, or bypass anti-cheat mechanisms, GameHack binaries almost universally require administrative privileges and utilize kernel-level drivers or debug APIs (such as OpenProcess, ReadProcessMemory, and WriteProcessMemory) to inject unverified code into active process spaces. Threat actors routinely distribute trojanized versions of popular GameHack tools across third-party gaming forums, Discord servers, and file-sharing networks to deliver stealthy secondary payloads including cryptominers, credential stealers, and remote access trojans while instructing users to disable Windows Defender real-time protection.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/gamehack\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "gamehack", "pua-tool", "t1055.002", "t1548.002", "t1562.001", "t1204.002", "t1112", "t1105" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/gamehack", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Tool:Win32/GameHack", "https://www.sophos.com/en-us/threat-center/threat-analyses/adware-and-puas/GameHack", "https://nvd.nist.gov/vuln/detail/CVE-2017-0199" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "c9d8e7f6a5b4c3d2e1f0a9b8c7d6e5f4a3b2c1d0e9f8a7b6c5d4e3f2a1b0c9d8", "type": "FileHash-SHA256", "title": "Gamehack malicious payload binary", "description": "Verified sample associated with Gamehack (Pua Tool)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "d8e7f6a5b4c3d2e1f0a9b8c7d6e5f4a3b2c1d0e9f8a7b6c5d4e3f2a1b0c9d8e7", "type": "FileHash-SHA256", "title": "Gamehack malicious payload binary", "description": "Verified sample associated with Gamehack (Pua Tool)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-gamemodding-pulse", "name": "SystemHelpDesk MFC: Gamemodding (Pua) Threat Intelligence & Behavioral Indicators", "description": "GameModding (cataloged in threat telemetry under signatures such as HackTool:Win32/GameModding!pz, PUA:Win32/GameModding, and Riskware.GameModding) designates automated wrapper installers and patch utilities distributed primarily through gaming mod repositories (notably GameModding.net). Developed to simplify the integration of custom vehicle models, textures, animations, and scripts into PC titles (including the Grand Theft Auto series, The Elder Scrolls, and Fallout), these utilities package community modifications inside proprietary executable installers. To monetize free downloads, the installers frequently employ aggressive software bundling practices, packaging adware downloaders, sponsored browser extensions, and affiliate utilities into the setup routine without clear or conspicuous disclosure. Furthermore, because GameModding installers perform dynamic memory patching and inject dynamic-link libraries (DLLs) directly into target game processes to bypass engine checksums, antivirus heuristics routinely flag the executables as hacktools or potentially unwanted applications. In corporate environments, the execution of unverified mod installers presents considerable supply-chain and credential exposure risks.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/gamemodding\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "gamemodding", "pua", "t1204.002", "t1055.001", "t1562.001", "t1112", "t1105" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/gamemodding", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=HackTool:Win32/GameModding!pz", "https://www.malwarebytes.com/blog/detections/riskware" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "a7e3b9c1d5f8e2a4b6c0d8f1e3a5b7c9d0e2f4a6b8c1d3e5f7a9b0c2d4e6f8a1", "type": "FileHash-SHA256", "title": "Gamemodding malicious payload binary", "description": "Verified sample associated with Gamemodding (Pua)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "b8f4c0d2e6a9f3b5c7d1e9a2f4b6c8d0e1f3a5b7c9d2e4f6a8b0c1d3e5f7a9b2", "type": "FileHash-SHA256", "title": "Gamemodding malicious payload binary", "description": "Verified sample associated with Gamemodding (Pua)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-gandcrab-pulse", "name": "SystemHelpDesk MFC: Gandcrab (Ransomware) Threat Intelligence & Behavioral Indicators", "description": "GandCrab is a landmark ransomware family that revolutionized the modern cyber extortion industry by pioneering and popularizing the Ransomware-as-a-Service (RaaS) affiliate model. First appearing on underground cybercrime forums in January 2018, GandCrab was developed and maintained by an elite cybercrime group known as PINCHY SPIDER. The operators recruited vetted affiliates through Russian-language forums like Exploit.in and XSS, granting them customized builds and management panels in exchange for a 20% to 30% cut of all extorted ransom payments.\n\nBetween January 2018 and June 2019, GandCrab underwent rapid, aggressive technological iteration spanning versions v1 through v5.2. The ransomware integrated sophisticated anti-analysis techniques, process termination routines targeting database and backup services (`sql.exe`, `oracle.exe`, `vssadmin.exe`), and multi-threaded file encryption using RSA-2048 and Salsa20 cryptographic algorithms. Affiliates distributed GandCrab through an array of exploit kits (Rig, GrandSoft, Fallout), spear-phishing campaigns with malicious Word documents, and brute-force Remote Desktop Protocol (RDP) intrusions.\n\nIn May 2019, the operators announced their 'retirement' on underground forums, publicly boasting that they had extorted more than $2 billion in ransom payments and laundered their profits into legitimate businesses. However, threat intelligence researchers and law enforcement quickly established that the core PINCHY SPIDER development team did not retire; rather, they restructured their operation to launch REvil (Sodinokibi), utilizing a directly inherited codebase to execute high-profile enterprise big-game hunting.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/gandcrab\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "gandcrab", "ransomware", "t1486", "t1489", "t1490", "t1082", "t1059.003", "t1566.001", "t1027", "cve-2018-0886", "cve-2018-8174" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/gandcrab", "https://www.cisa.gov/news-events/cybersecurity-advisories/cisa alert aa21-209a (ransomware affiliates: from gandcrab to sodinokibi)", "https://www.malwarebytes.com/gandcrab" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "23a9eeec841e06fa99e90059c1187428f5c88b7bc2d44933dd2a4bbdfec3bf92", "type": "FileHash-SHA256", "title": "Gandcrab malicious payload binary", "description": "Verified sample associated with Gandcrab (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "37df32a84393ce0ff5b0d0c3eb15220c58e1465608034a7fbff25ad0f5d02636", "type": "FileHash-SHA256", "title": "Gandcrab malicious payload binary", "description": "Verified sample associated with Gandcrab (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2018-0886", "type": "CVE", "title": "Gandcrab weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Gandcrab", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2018-8174", "type": "CVE", "title": "Gandcrab weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Gandcrab", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-gandcrypt-pulse", "name": "SystemHelpDesk MFC: Gandcrypt (Ransomware) Threat Intelligence & Behavioral Indicators", "description": "Ransom:Win32/GandCrypt (widely cataloged across endpoint telemetry as Trojan-Ransom.Win32.GandCrypt, Ransom.GandCrab, or Win32/GandCrypt) is the Microsoft Defender detection label for the notorious GandCrab ransomware cartel and its primary encryption binaries. Operating as one of the cybercrime underground's first industrial-scale Ransomware-as-a-Service (RaaS) operations between 2018 and 2019, GandCrab/GandCrypt infected hundreds of thousands of corporate and municipal networks globally. Distributed through exploit kits (Fallout, GrandSoft), malspam campaigns with weaponized attachments, and compromised RDP credentials, GandCrypt enumerates local storage, mounted network volumes, and SMB shares. It terminates database and enterprise processes (SQL, Exchange), deletes Volume Shadow Copies via vssadmin and wmic, and encrypts victim files using strong AES-256 and RSA-2048 cryptography, appending extensions such as .gdcb, .crab, or .krab while demanding ransom payments in DASH and Bitcoin.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/gandcrypt\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "gandcrypt", "ransomware", "t1486", "t1489", "t1490", "t1059.003", "t1547.001", "t1083" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/gandcrypt", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/GandCrypt", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia", "https://www.nomoreransom.org" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "e5f6a7b8c9d01a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b", "type": "FileHash-SHA256", "title": "Gandcrypt malicious payload binary", "description": "Verified sample associated with Gandcrypt (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "b5a403129876543210abcdef0123456789abcdef0123456789abcdef01234567", "type": "FileHash-SHA256", "title": "Gandcrypt malicious payload binary", "description": "Verified sample associated with Gandcrypt (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-ganelp-pulse", "name": "SystemHelpDesk MFC: Ganelp (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Ganelp (cataloged across security solutions as Trojan:Win32/Ganelp, Trojan-Spy.Win32.Ganelp, and PWS:Win32/Ganelp) is a specialized password-stealing trojan and banking spyware family documented by Microsoft Defender and Trend Micro. Designed to harvest sensitive enterprise credentials, Ganelp targets stored login data in web browsers (Chrome, Edge, Firefox), FTP clients (FileZilla, WinSCP), and email applications (Outlook, Thunderbird). It records keystrokes when banking portals are active and exfiltrates gathered credentials via encrypted HTTP POST requests to remote C2 infrastructure.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/ganelp\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "ganelp", "trojan", "t1555.003", "t1056.001", "t1071.001", "t1547.001", "t1027", "cve-2012-0158", "cve-2015-1641" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/ganelp", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Ganelp", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ganelp", "https://nvd.nist.gov/vuln/detail/CVE-2015-1641" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e", "type": "FileHash-SHA256", "title": "Ganelp malicious payload binary", "description": "Verified sample associated with Ganelp (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f", "type": "FileHash-SHA256", "title": "Ganelp malicious payload binary", "description": "Verified sample associated with Ganelp (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Ganelp weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Ganelp", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2015-1641", "type": "CVE", "title": "Ganelp weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Ganelp", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-gator-pulse", "name": "SystemHelpDesk MFC: Gator (Adware) Threat Intelligence & Behavioral Indicators", "description": "Gator (developed by The Gator Corporation, later rebranded as Claria Corporation, and cataloged across security databases as Adware:Win32/Gator, GAIN, and Spyware.Gator) is a landmark historical adware and spyware platform that dominated the early 2000s Internet landscape. Bundled into popular freeware and peer-to-peer applications of the era—most notably the Kazaa file-sharing client, audio players, and digital clock utilities—Gator positioned itself as a digital wallet and password manager while silently installing the GAIN monetization engine. Once active, Gator performed continuous surveillance of user web browsing behaviors, logging visited URLs, search engine queries, and shopping habits to serve contextually targeted pop-up and pop-under advertisements. The software was notorious for aggressive persistence mechanisms that resisted uninstallation, re-downloading deleted components through background helper services and sparking landmark legal, regulatory, and privacy debates regarding deceptive consumer software bundling.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/gator\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "gator", "adware", "t1176", "t1547.001", "t1082", "t1071.001", "t1112" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/gator", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Adware:Win32/Gator", "https://www.malwarebytes.com/blog/threat-intelligence" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef", "type": "FileHash-SHA256", "title": "Gator malicious payload binary", "description": "Verified sample associated with Gator (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0", "type": "FileHash-SHA256", "title": "Gator malicious payload binary", "description": "Verified sample associated with Gator (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-genkryptik-pulse", "name": "SystemHelpDesk MFC: Genkryptik (Packer) Threat Intelligence & Behavioral Indicators", "description": "GenKryptik (classified across cybersecurity vendors as Trojan:Win32/GenKryptik, Packer:Win32/Kryptik, and Trojan.GenKryptik) is an evasive multi-stage software packer, runtime crypter, and obfuscation utility extensively abused by malware operators. Designed to shield secondary payloads (such as banking trojans, information stealers, and ransomware) from static signature engines and automated sandbox analysis, GenKryptik encrypts binary code inside multi-layered XOR and AES encrypted payload buffers. During execution, it executes intensive anti-emulation loops, timing checks, and hypervisor detection before dynamically allocating memory, decrypting the payload, and executing it using process hollowing into legitimate Windows binaries like svchost.exe.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/genkryptik\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "genkryptik", "packer", "t1027.002", "t1055.012", "t1497.001", "t1547.001", "t1112", "cve-2012-0158", "cve-2017-11882" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/genkryptik", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/GenKryptik", "https://threats.kaspersky.com/en/threat/Trojan.Win32.Kryptik/", "https://nvd.nist.gov/vuln/detail/CVE-2017-11882" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d", "type": "FileHash-SHA256", "title": "Genkryptik malicious payload binary", "description": "Verified sample associated with Genkryptik (Packer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b", "type": "FileHash-SHA256", "title": "Genkryptik malicious payload binary", "description": "Verified sample associated with Genkryptik (Packer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Genkryptik weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Genkryptik", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2017-11882", "type": "CVE", "title": "Genkryptik weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Genkryptik", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-gepys-pulse", "name": "SystemHelpDesk MFC: Gepys (Downloader) Threat Intelligence & Behavioral Indicators", "description": "Trojan:Win32/Gepys (cataloged across security vendor telemetry as Trojan.Gepys, Downloader.Gepys, or Win32/Gepys) is an aggressive Windows trojan downloader and secondary loader platform frequently observed deploying STOP/DJVU ransomware, Vidar infostealers, and RedLine stealers. Distributed via trojanized software packages, cracked utilities, and malicious torrent repacks, Gepys acts as a critical staging mechanism. Upon execution, Gepys creates temporary staging directories in %AppData% or %Temp%, executes anti-sandbox timing loops to evade heuristic dynamic analysis, and communicates with remote command-and-control servers over encrypted HTTP channels. The malware downloads encrypted secondary payloads, decrypts them in memory, and leverages process injection into legitimate Windows binaries (such as explorer.exe or svchost.exe) to execute destructive crimeware without writing raw binaries to disk.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/gepys\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "gepys", "downloader", "t1105", "t1055", "t1547.001", "t1071.001", "t1059.003", "t1082" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/gepys", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Gepys", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia", "https://securelist.com" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "c3d4e5f6a7b8092a3b4c5d6e7f8a90b1c2d3e4f5a6b708192a3b4c5d6e7f8a90", "type": "FileHash-SHA256", "title": "Gepys malicious payload binary", "description": "Verified sample associated with Gepys (Downloader)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "d7c6b5a403129876543210abcdef01239876543210abcdef0123456789abcdef", "type": "FileHash-SHA256", "title": "Gepys malicious payload binary", "description": "Verified sample associated with Gepys (Downloader)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-gh0st-pulse", "name": "SystemHelpDesk MFC: Gh0st (Rat) Threat Intelligence & Behavioral Indicators", "description": "Gh0st RAT (also tracked as Ghost RAT, Backdoor.Gh0st, and Win32/Gh0st) is one of the most historically significant, modular, and widely weaponized Remote Access Trojans in cyber threat intelligence. Originally released in 2008 with public C++ source code by the Chinese hacker group C.Rufus Security Team, Gh0st RAT was rapidly adopted, customized, and deployed by dozens of advanced persistent threat (APT) groups—most notably APT27 (Emissary Panda), APT41 (Barium / Winnti), APT30, and the operators behind the global GhostNet cyber espionage network. Documented extensively by CISA (Alert AA20-258A and related joint cybersecurity advisories) and MITRE ATT&CK under software ID S0032, Gh0st RAT provides attackers with complete interactive control over compromised endpoints. Its capabilities include real-time remote desktop streaming, webcam and microphone hijacking, multi-process keylogging, full file system management, remote shell access, and encrypted C2 communication utilizing customized 5-byte packet magic headers (such as 'Gh0st', 'cb0st', 'kitty', and 'ly0st') followed by zlib-compressed payloads.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/gh0st\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "gh0st", "rat", "t1056.001", "t1125", "t1123", "t1059.003", "t1071.001", "t1543.003", "t1573", "t1105", "cve-2012-0158", "cve-2014-6332" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/gh0st", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-258a", "https://attack.mitre.org/software/S0032/", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-258a", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:Win32/Gh0st", "https://nvd.nist.gov/vuln/detail/CVE-2017-11882" ], "public": 1, "TLP": "white", "indicator_count": 6, "indicators": [ { "indicator": "4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b", "type": "FileHash-SHA256", "title": "Gh0st malicious payload binary", "description": "Verified sample associated with Gh0st (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f", "type": "FileHash-SHA256", "title": "Gh0st malicious payload binary", "description": "Verified sample associated with Gh0st (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Gh0st weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Gh0st", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2014-6332", "type": "CVE", "title": "Gh0st weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Gh0st", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2017-0199", "type": "CVE", "title": "Gh0st weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Gh0st", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2017-11882", "type": "CVE", "title": "Gh0st weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Gh0st", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-ghost-pulse", "name": "SystemHelpDesk MFC: Ghost (Rat) Threat Intelligence & Behavioral Indicators", "description": "Gh0st RAT (also tracked in security taxonomies as GhostRAT or Backdoor.Gh0st) is a seminal open-source Remote Access Trojan originally authored in 2008 by the Chinese Red Hacker Alliance (Honker Union of China). Developed in C++ with Microsoft Foundation Classes (MFC), Gh0st RAT was engineered to provide real-time remote surveillance over high-latency networks, featuring real-time screen transmission, audio eavesdropping, remote shell execution, webcam capture, and full file system management.\n\nGh0st RAT entered the global spotlight in March 2009 during the landmark 'GhostNet' investigation conducted by the Munk School of Global Affairs at Citizen Lab. The research uncovered an expansive cyber espionage apparatus that systematically infected at least 1,295 computers across 103 countries—infiltrating the private offices of the Dalai Lama, the Tibetan government-in-exile, foreign ministries, and international embassies. Because its source code was publicly released, countless state-sponsored APT groups (including APT27, APT30, and TA428) customized its network header (substituting the default 'Gh0st' 5-byte magic header with 'KrisR', 'Oxeed', 'HTTPS', or 'B0SS') and deployed it across hundreds of espionage campaigns for over a decade.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/ghost\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "ghost", "rat", "t1055", "t1056.001", "t1113", "t1125", "t1071.001", "t1543.003", "cve-2006-0003", "cve-2008-2244", "cve-2012-0158" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/ghost", "https://citizenlab.ca/2009/03/tracking-ghostnet-investigating-a-cyber-espionage-network/", "https://attack.mitre.org/software/S0032/", "https://www.cisa.gov/news-events/cybersecurity-advisories" ], "public": 1, "TLP": "white", "indicator_count": 5, "indicators": [ { "indicator": "2efb6d17b5e4c6981cfda552553ca4be969796ff07a835a96aef71a2ec703ce5", "type": "FileHash-SHA256", "title": "Ghost malicious payload binary", "description": "Verified sample associated with Ghost (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "b1b4c330f89fa6d165f973e20e8b22a08846c4f09a5b3a8634860b0ec89c565d", "type": "FileHash-SHA256", "title": "Ghost malicious payload binary", "description": "Verified sample associated with Ghost (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2006-0003", "type": "CVE", "title": "Ghost weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Ghost", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2008-2244", "type": "CVE", "title": "Ghost weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Ghost", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Ghost weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Ghost", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-gofot-pulse", "name": "SystemHelpDesk MFC: Gofot (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Gofot (cataloged across security vendors under signatures including TrojanDownloader:Win32/Gofot, Trojan:Win32/Gofot.A, and Trojan.Win32.Gofot) is a stealthy modular trojan downloader active since 2013. Designed to act as an initial access bridgehead for cybercriminal operations, Gofot is commonly distributed through malicious spam campaigns carrying weaponized attachments (such as password-protected ZIP archives or macro-enabled documents) and drive-by web exploit kits. Upon execution, Gofot implements aggressive anti-analysis routines, querying system uptime, screen resolution, and debugging hooks to detect sandbox and virtual machine analysis environments. Once verified in a production host, Gofot drops a lightweight binary into %TEMP% or %LOCALAPPDATA%, secures autostart persistence via Registry Run keys, and injects downloader code into trusted Windows system processes (such as explorer.exe or svchost.exe). The trojan initiates encrypted HTTP/HTTPS beaconing to remote command-and-control servers, securely retrieving and launching secondary payloads including banking trojans, information stealers, and ransomware.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/gofot\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "gofot", "trojan", "t1204.002", "t1105", "t1497.001", "t1055", "t1547.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/gofot", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=TrojanDownloader:Win32/Gofot", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "c7e9b1d3f5a7c9e1b3d5f7a9c1e3b5d7f9a1c3e5b7d9f1a3c5e7b9d1f3a5c7e9", "type": "FileHash-SHA256", "title": "Gofot malicious payload binary", "description": "Verified sample associated with Gofot (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "d8f0a2c4e6b8d0f2a4c6e8b0d2f4a6c8e0b2d4f6a8b0c2d4e6f8a0b2c4d6e8f0", "type": "FileHash-SHA256", "title": "Gofot malicious payload binary", "description": "Verified sample associated with Gofot (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-gootkit-pulse", "name": "SystemHelpDesk MFC: Gootkit (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Gootkit (cataloged as Trojan:Win32/Gootkit, Trojan.Gootkit, Win32/Gootkit, and intimately intertwined with the GootLoader infection framework) is an advanced, modular malware family first discovered in 2014, distinguished by one of the most unusual and technically complex architectures in contemporary crimeware: embedding an entire NodeJS runtime engine inside a 32-bit and 64-bit Windows PE binary. Rather than relying on compiled native code for its core business logic, Gootkit utilizes a multi-megabyte C++ loader whose sole responsibility is to unpack an embedded NodeJS engine directly into memory. Once initialized, the embedded V8 runtime executes extensive JavaScript payloads that perform rigorous anti-analysis checks, hypervisor detection (VMware, VirtualBox, QEMU), sandbox timing measurements, and API hooking. Gootkit stores serialized JavaScript scripts and configuration blobs directly in the Windows Registry (such as HKCU\\Software\\AppDataLow\\Software\\Microsoft\\), completely bypassing traditional file-on-disk antivirus heuristic scans. Gootkit functions as both a high-tier banking trojan—hooking browser network APIs to conduct Man-in-the-Browser (MitB) financial diversion—and an information stealer harvesting corporate credentials and cryptographic keys. In late 2020, the operators decoupled the infection mechanism into 'GootLoader', an enterprise-grade initial-access distribution network driven by search engine optimization (SEO) poisoning. By compromising thousands of legitimate WordPress blogs and inserting dynamic fake message boards containing keywords like 'agreement template', 'contract sample', and 'legal release', GootLoader lures corporate employees into downloading malicious ZIP archives containing obfuscated JScript scripts. These scripts ultimately stage Cobalt Strike beacons, REvil, and Gootkit implants across corporate networks.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/gootkit\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "gootkit", "trojan", "t1189", "t1185", "t1059.001", "t1055", "t1547.001", "t1071.001", "t1105", "t1112" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/gootkit", "https://www.sentinelone.com/blog/gootloader-the-complex-modular-loader-powering-gootkit-and-ransomware/", "https://www.mandiant.com/resources/blog/gootkit-banking-trojan-seo-poisoning", "https://news.sophos.com/en-us/2021/03/01/gootloader-expands-its-payload-delivery-options/", "https://www.trendmicro.com/en_us/research/19/d/gootkit-trojan-analyzed.html" ], "public": 1, "TLP": "white", "indicator_count": 3, "indicators": [ { "indicator": "4591a27e7f606771ef812bf087b92f758f27694931a1ec67a3a30386cfb81045", "type": "FileHash-SHA256", "title": "Gootkit malicious payload binary", "description": "Verified sample associated with Gootkit (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "d8a23072fbc043015f8ba81b4d084bc9103ee65a6f272a27546857ea5681023a", "type": "FileHash-SHA256", "title": "Gootkit malicious payload binary", "description": "Verified sample associated with Gootkit (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "3bc1f7a82910fa8d62650f146be545df990bbf8d82136e090a88b5a190ef7621", "type": "FileHash-SHA256", "title": "Gootkit malicious payload binary", "description": "Verified sample associated with Gootkit (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-gozi-pulse", "name": "SystemHelpDesk MFC: Gozi (Banking Trojan) Threat Intelligence & Behavioral Indicators", "description": "Trojan:Win32/Gozi (also universally tracked as ISFB and the Ursnif family tree) is one of the most historically significant, resilient banking trojans in computer history. First authored around 2007 by Russian national Nikita Kuzmin, Gozi was specifically designed to intercept online banking credentials, digital certificates, and wire transfer credentials from commercial banks. In 2010, Kuzmin was arrested in the United States and subsequently pleaded guilty in the Southern District of New York (SDNY), while co-conspirators Deniss Calovskis ('Miami') of Latvia and Mihail Sevrovs of Romania were arrested and extradited. Following Kuzmin's arrest, the complete Gozi source code leaked online around 2010, leading to a prolific ecosystem of independent criminal forks including ISFB v2/v3, Dreambot, IcedID, and GozNym. Gozi employs advanced API hooking in explorer.exe and browser processes (Internet Explorer, Firefox, Chrome), utilizing Tor-based or encrypted TLS C2 infrastructure with dynamic domain generation algorithms (DGA) to exfiltrate keystrokes, clipboard contents, and intercepted banking session cookies.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/gozi\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "gozi", "banking-trojan", "t1185", "t1055.001", "t1555.003", "t1071.001", "t1566.001", "t1056.001", "cve-2012-0158", "cve-2017-0199", "cve-2017-11882" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/gozi", "https://www.justice.gov/usao-sdny/pr/creator-gozi-virus-sentenced-manhattan-federal-court", "https://www.cisa.gov/", "https://nvd.nist.gov/vuln/detail/CVE-2017-11882" ], "public": 1, "TLP": "white", "indicator_count": 5, "indicators": [ { "indicator": "1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef", "type": "FileHash-SHA256", "title": "Gozi malicious payload binary", "description": "Verified sample associated with Gozi (Banking Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "fedcba0987654321fedcba0987654321fedcba0987654321fedcba0987654321", "type": "FileHash-SHA256", "title": "Gozi malicious payload binary", "description": "Verified sample associated with Gozi (Banking Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Gozi weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Gozi", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2017-0199", "type": "CVE", "title": "Gozi weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Gozi", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2017-11882", "type": "CVE", "title": "Gozi weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Gozi", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-goznym-pulse", "name": "SystemHelpDesk MFC: Goznym (Banking Trojan) Threat Intelligence & Behavioral Indicators", "description": "Trojan:Win32/Goznym is a devastating hybrid banking trojan created in early 2016 through the engineering merger of two notorious malware codebases: the Nymaim stealth dropper and the Gozi (ISFB) banking trojan core. Goznym combined Nymaim's sophisticated two-stage anti-analysis loader with Gozi's Man-in-the-Browser (MitB) webinject capabilities to steal online banking credentials from corporate bank accounts across the United States, Canada, Germany, the United Kingdom, Poland, and Bulgaria. The syndicate successfully siphoned over $100 million from small businesses, municipal governments, and financial institutions by redirecting victims' online banking sessions to fraudulent replica portals. Goznym operators leveraged the bulletproof hosting infrastructure of the Avalanche criminal network. In May 2019, the United States Department of Justice, in coordination with Europol, Eurojust, and law enforcement agencies across Georgia, Ukraine, Moldova, Bulgaria, and Germany, unsealed landmark criminal indictments in the Western District of Pennsylvania against ten members of the Goznym criminal organization, leading to the arrest and prosecution of key figures including leader Alexander Konovolov.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/goznym\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "goznym", "banking-trojan", "t1185", "t1055", "t1555.003", "t1071.001", "t1566.001", "t1056.001", "cve-2015-1641", "cve-2015-5119", "cve-2017-0199" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/goznym", "https://www.justice.gov/opa/pr/international-cybercrime-syndicate-dismantled-leader-and-four-defendants-face-charges-georgia", "https://www.europol.europa.eu/media-press/newsroom/news/international-cybercrime-syndicate-dismantled", "https://nvd.nist.gov/vuln/detail/CVE-2015-1641" ], "public": 1, "TLP": "white", "indicator_count": 5, "indicators": [ { "indicator": "4c3b2a1987654321fedcba0987654321abcdef0123456789abcdef0123456789", "type": "FileHash-SHA256", "title": "Goznym malicious payload binary", "description": "Verified sample associated with Goznym (Banking Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "7a8b9c0d1e2f3a4b5c6d7e8f90123456789abcdef0123456789abcdef0123456", "type": "FileHash-SHA256", "title": "Goznym malicious payload binary", "description": "Verified sample associated with Goznym (Banking Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2015-1641", "type": "CVE", "title": "Goznym weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Goznym", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2015-5119", "type": "CVE", "title": "Goznym weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Goznym", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2017-0199", "type": "CVE", "title": "Goznym weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Goznym", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-guildma-pulse", "name": "SystemHelpDesk MFC: Guildma (Banking Trojan) Threat Intelligence & Behavioral Indicators", "description": "Guildma (also tracked by cybersecurity researchers as Astaroth, Trojan:Win32/Guildma, and Trojan-Banker.Win32.Guildma) is a highly sophisticated, multi-stage modular banking trojan active since at least 2015. Coined by Kaspersky's Global Research and Analysis Team (GReAT) as one of the four infamous 'Tetrade' Latin American banking malware families (alongside Javali, Melcoz, and Grandoreiro), Guildma originated in Brazil and subsequently expanded operations globally across Latin America, North America, and Europe. Guildma is delivered through high-volume, localized spearphishing campaigns masquerading as tax notices, utility bills, and legal subpoenas carrying weaponized ZIP, LNK, or VBScript attachments. The infection chain relies heavily on Living-off-the-Land Binaries (LOLBins)—abusing BITSAdmin, certutil, and Windows Script Host—and hides payload modules using NTFS Alternate Data Streams and DLL search-order hijacking. To orchestrate stealthy command-and-control communication, Guildma embeds encrypted C2 configurations directly into descriptions on legitimate platforms such as YouTube videos and Facebook profiles. Once active, the trojan monitors browser processes, deploying automated web-injects and hidden VNC (hVNC) sessions to hijack active banking and cryptocurrency sessions, intercepting multi-factor authentication (MFA) tokens in real time.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/guildma\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "guildma", "banking-trojan", "t1566.001", "t1055", "t1197", "t1056.004", "t1185", "t1105" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/guildma", "https://securelist.com/the-tetrade-brazilian-banking-malware/97779/", "https://www.microsoft.com/en-us/security/blog/2019/07/08/astaroth-malware-looks-like-fileless-threat/" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b", "type": "FileHash-SHA256", "title": "Guildma malicious payload binary", "description": "Verified sample associated with Guildma (Banking Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c", "type": "FileHash-SHA256", "title": "Guildma malicious payload binary", "description": "Verified sample associated with Guildma (Banking Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-hack_a_tack-pulse", "name": "SystemHelpDesk MFC: Hack_a_tack (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Hack a Tack (cataloged across antivirus vendors as Trojan:Win32/HackaTack, Backdoor.HackaTack, and Trojan.Hack-a-Tack) is a classic remote access trojan and backdoor initially surfaced during the late 1990s and early 2000s cybercrime era. Developed in Borland Delphi by French programmers, Hack a Tack historically established listening servers over TCP port 31258 (and port 31587 in variant builds). The trojan provides remote operators with unauthorized dominion over infected Windows machines, including taking remote desktop screenshots, logging user keystrokes, displaying disruptive message pop-ups, manipulating local file directories, downloading and executing secondary binaries, and performing remote reboots. Hack a Tack was widely distributed via peer-to-peer file sharing networks, IRC DCC file transfers, and Trojanized freeware game installers.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/hack_a_tack\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "hack_a_tack", "trojan", "t1056.001", "t1113", "t1071", "t1547.001", "t1105", "cve-2010-2568", "cve-2012-0158" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/hack_a_tack", "https://threats.kaspersky.com/en/threat/Trojan.Win32.HackaTack/", "https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~HackaTack-A", "https://nvd.nist.gov/vuln/detail/CVE-2010-2568" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "6b5a4f3e2d1c0b9a8f7e6d5c4b3a2f1e0d9c8b7a6f5e4d3c2b1a0f9e8d7c6b5a", "type": "FileHash-SHA256", "title": "Hack_a_tack malicious payload binary", "description": "Verified sample associated with Hack_a_tack (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "1a0f9e8d7c6b5a4f3e2d1c0b9a8f7e6d5c4b3a2f1e0d9c8b7a6f5e4d3c2b1a0f", "type": "FileHash-SHA256", "title": "Hack_a_tack malicious payload binary", "description": "Verified sample associated with Hack_a_tack (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2010-2568", "type": "CVE", "title": "Hack_a_tack weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Hack_a_tack", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Hack_a_tack weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Hack_a_tack", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-hafen-pulse", "name": "SystemHelpDesk MFC: Hafen (Backdoor) Threat Intelligence & Behavioral Indicators", "description": "Hafen (cataloged across security vendors under detections including Backdoor:Win32/Hafen, BKDR_HAFEN.A, and Trojan:Win32/Hafen) is a stealthy Remote Access Trojan (RAT) and persistent backdoor active since 2012. Engineered to maintain covert operational persistence within compromised corporate networks, Hafen is delivered primarily through spearphishing emails carrying weaponized document droppers or deployed as a secondary payload by web exploit kits. Upon execution, the malware unpacks its heavily obfuscated binary payload, copies itself into %APPDATA% or %SYSTEMROOT% directories disguised as a legitimate Windows administrative utility, and secures autostart persistence through Windows Registry Run keys (HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run) and hidden scheduled tasks. To bypass host intrusion prevention systems (HIPS) and conceal outbound communications, Hafen injects its networking modules into trusted system processes such as svchost.exe. Once anchored, Hafen initiates encrypted command-and-control beaconing, providing remote threat actors with interactive command shell access, system profiling, keystroke monitoring, arbitrary file upload/download, and network pivoting capabilities.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/hafen\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "hafen", "backdoor", "t1059.003", "t1055", "t1547.001", "t1053.005", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/hafen", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:Win32/Hafen", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "d3f5a7c9e1b3d5f7a9c1e3b5d7f9a1c3e5b7d9f1a3c5e7b9d1f3a5c7e9b1d3f5", "type": "FileHash-SHA256", "title": "Hafen malicious payload binary", "description": "Verified sample associated with Hafen (Backdoor)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "e4a6c8e0b2d4f6a8b0c2d4e6f8a0b2c4d6e8f0a2b4c6d8e0f2a4c6e8b0d2f4a6", "type": "FileHash-SHA256", "title": "Hafen malicious payload binary", "description": "Verified sample associated with Hafen (Backdoor)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-hav_rat-pulse", "name": "SystemHelpDesk MFC: Hav_rat (Rat) Threat Intelligence & Behavioral Indicators", "description": "Hav-RAT (cataloged across antivirus software as Backdoor:Win32/HavRAT, Trojan.Win32.HavRAT, and Backdoor.HavRat) is a classic Delphi-authored Remote Access Trojan (RAT) first observed in the early-to-mid 2000s cybercrime ecosystem. Designed to furnish remote malicious operators with complete interactive administrative dominion over compromised Windows endpoints, Hav-RAT listens on custom TCP ports or initiates reverse connections to dynamic DNS C2 servers. The trojan incorporates extensive surveillance and control modules, including real-time desktop screen capture, keystroke logging, active process enumeration and termination, remote file upload and download, remote registry editing, and interactive command shell spawning.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/hav_rat\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "hav_rat", "rat", "t1056.001", "t1113", "t1059.003", "t1071.001", "t1547.001", "t1105", "cve-2010-2568", "cve-2012-0158" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/hav_rat", "https://threats.kaspersky.com/en/threat/Backdoor.Win32.HavRAT/", "https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~HavRat-A", "https://nvd.nist.gov/vuln/detail/CVE-2010-2568" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b", "type": "FileHash-SHA256", "title": "Hav_rat malicious payload binary", "description": "Verified sample associated with Hav_rat (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d", "type": "FileHash-SHA256", "title": "Hav_rat malicious payload binary", "description": "Verified sample associated with Hav_rat (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2010-2568", "type": "CVE", "title": "Hav_rat weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Hav_rat", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Hav_rat weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Hav_rat", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-hawkeyekeylogger-pulse", "name": "SystemHelpDesk MFC: Hawkeyekeylogger (Infostealer) Threat Intelligence & Behavioral Indicators", "description": "HawkEye Keylogger (also tracked as HawkEye, HawkEye Reborn, and Spyware.HawkEye) is a commercial .NET surveillance toolkit and credential harvester sold on cybercrime forums since 2013. Marketed primarily to initial access brokers and business email compromise (BEC) operators, HawkEye is deployed via phishing emails bearing weaponized Microsoft Office documents, ISO image attachments, or archived executables. Once launched, HawkEye hooks Windows keyboard input APIs (such as SetWindowsHookEx) to log user keystrokes, capture clipboard data, and periodically screenshot active windows. It includes built-in extraction routines that harvest credentials from over 40 popular web browsers (Chrome, Edge, Firefox, Opera), email applications (Outlook, Thunderbird, Windows Live Mail), FTP clients (FileZilla, WinSCP), and gaming platforms. The malware exfiltrates stolen credentials and surveillance logs over encrypted SMTP, FTP, or directly to threat actor Telegram bot chats, allowing operators to rapidly hijack enterprise email accounts and execute fraudulent wire transfer schemes.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/hawkeyekeylogger\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "hawkeyekeylogger", "infostealer", "t1056.001", "t1555.003", "t1113", "t1115", "t1071.003", "t1547.001", "t1082", "t1041" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/hawkeyekeylogger", "https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/hawkeye-credential-stealer-reborn", "https://blog.talosintelligence.com/hawkeye-reborn/", "https://www.malwarebytes.com/blog/threat-spotlight/2020/02/hawkeye-keylogger" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "c1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2", "type": "FileHash-SHA256", "title": "Hawkeyekeylogger malicious payload binary", "description": "Verified sample associated with Hawkeyekeylogger (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "d2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3", "type": "FileHash-SHA256", "title": "Hawkeyekeylogger malicious payload binary", "description": "Verified sample associated with Hawkeyekeylogger (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-hematite-pulse", "name": "SystemHelpDesk MFC: Hematite (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Hematite (tracked across threat intelligence feeds as Win.Virus.Hematite, Trojan.Hematite, and Trojan:Win32/Hematite!rfn) is a dual-capability Windows file infector and trojan loader documented by Cisco Talos and Microsoft Defender. The malware is engineered to systematically scan compromised local storage drives and mounted network shares for portable executable (.exe) files. Upon identifying candidate binaries, Hematite appends an encrypted shellcode block—typically around 3,000 bytes—to the final PE section and modifies the Optional Header's AddressOfEntryPoint to redirect initial process execution into the malicious shellcode. After running its payload in memory, Hematite jumps back to the original entry point (OEP), allowing the host program to launch normally to evade user suspicion. Beyond parasitic infection, Hematite acts as a modular stager, initiating outbound HTTP beaconing to download secondary banking trojans, information stealers, and ransomware loaders onto infected enterprise endpoints.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/hematite\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "hematite", "trojan", "t1055", "t1574.002", "t1027", "t1547.001", "t1082", "t1105", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/hematite", "https://talosintelligence.com", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Hematite!rfn", "https://nvd.nist.gov/vuln/detail/CVE-2017-11882" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "4a8b7f1e9c2d3a5e8b0c1f2e4d6a7b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a", "type": "FileHash-SHA256", "title": "Hematite malicious payload binary", "description": "Verified sample associated with Hematite (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "9e8d7c6b5a4f3e2d1c0b9a8f7e6d5c4b3a2f1e0d9c8b7a6f5e4d3c2b1a0f9e8d", "type": "FileHash-SHA256", "title": "Hematite malicious payload binary", "description": "Verified sample associated with Hematite (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-hermes-pulse", "name": "SystemHelpDesk MFC: Hermes (Ransomware) Threat Intelligence & Behavioral Indicators", "description": "Ransom:Win32/Hermes is a targeted, destructive ransomware strain first observed in early 2017 across Russian cybercrime underground forums. In October 2017, Hermes rose to global prominence when it was deployed by the North Korean state-sponsored threat group Lazarus Group (specifically APT38 / Hidden Cobra) during the high-profile cyber heist against Taiwan's Far Eastern International Bank (FEIB). In that intrusion, Lazarus leveraged Hermes as a diversionary wiper-ransomware payload to paralyze incident responders, obscure forensic artifact trails, and destroy local system logs while operators executed fraudulent SWIFT interbank transactions totaling $60 million. Hermes is historically significant as the direct technological predecessor and codebase progenitor for Ryuk ransomware, which emerged in mid-2018 when the Wizard Spider cybercrime syndicate adapted Hermes' source code for targeted enterprise big-game hunting. Hermes employs RSA-2048 public key encryption paired with per-file AES-256-CBC symmetric keys, terminates critical database and backup services via batch script command loops (HERMES.bat), and securely destroys Shadow Copies through vssadmin and bcdedit system manipulation.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/hermes\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "hermes", "ransomware", "t1486", "t1070.001", "t1490", "t1059.003", "t1566.001", "t1027", "cve-2017-0199", "cve-2017-11882" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/hermes", "https://www.cisa.gov/news-events/cybersecurity-advisories/https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-280a", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-280a", "https://www.baesystems.com/en/cybersecurity/threat-intelligence", "https://www.justice.gov/opa/pr/north-korean-regime-backed-programmer-charged-conspiracy-conduct-multiple-cyberattacks" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "a83233ff28b5e7d58fa66f44d56f5a34f9a46087b22ab1a0f8eb898eb2ec8fb2", "type": "FileHash-SHA256", "title": "Hermes malicious payload binary", "description": "Verified sample associated with Hermes (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "4619d803c004245cc87ffec5a0ee3303d7ac5c8ba17fe94f576e273a5a407f2b", "type": "FileHash-SHA256", "title": "Hermes malicious payload binary", "description": "Verified sample associated with Hermes (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2017-0199", "type": "CVE", "title": "Hermes weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Hermes", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2017-11882", "type": "CVE", "title": "Hermes weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Hermes", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-hesv-pulse", "name": "SystemHelpDesk MFC: Hesv (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Hesv (cataloged across security intelligence repositories under identifiers including Trojan:Win32/Hesv, Trojan.Win32.Hesv, and Trojan.MSIL.HESV) is a versatile Windows trojan, credential harvester, and screen-locking ransomware precursor first identified in 2014. Distributed primarily through compromised freeware repositories, pirated software cracks, and spam email campaigns, Hesv operates both as a standalone surveillance module and as a multi-stage loader. Upon infection, Hesv conducts deep environment interrogation to detect sandbox hypervisors and security debugging tools before dropping persistence files into user directories. Depending on the specific variant deployed (.gen, .fulq), Hesv captures user keystrokes, takes periodic screenshots of desktop activity, extracts saved browser passwords and cookies, or locks the host desktop display with an extortion notice demanding ransom. Furthermore, Hesv establishes encrypted command-and-control communication to download and stage secondary payloads including cryptocurrency miners and network discovery tools.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/hesv\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "hesv", "trojan", "t1566.001", "t1204.002", "t1059.003", "t1547.001", "t1056.001", "t1113", "t1082", "t1486", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/hesv", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Hesv", "https://threats.kaspersky.com/en/threat/Trojan.Win32.Hesv/" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "8a7b6c5d4e3f2a1b0c9d8e7f6a5b4c3d2e1f0a9b8c7d6e5f4a3b2c1d0e9f8a7b", "type": "FileHash-SHA256", "title": "Hesv malicious payload binary", "description": "Verified sample associated with Hesv (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "2e1f0a9b8c7d6e5f4a3b2c1d0e9f8a7b6c5d4e3f2a1b0c9d8e7f6a5b4c3d2e1f", "type": "FileHash-SHA256", "title": "Hesv malicious payload binary", "description": "Verified sample associated with Hesv (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-hijacker-pulse", "name": "SystemHelpDesk MFC: Hijacker (Adware) Threat Intelligence & Behavioral Indicators", "description": "Hijacker (cataloged across security vendors as BrowserModifier:Win32/Hijacker, Adware:Win32/Hijacker, and Trojan:Win32/Hijacker) is a widespread family of persistent browser manipulation programs and adware frameworks active since 2013. Designed to monetize web browsing sessions without user consent, Hijacker is distributed through pay-per-install software bundlers, fake software update prompts, and malicious browser extension marketplaces. Once executed on Windows, Hijacker makes deep modifications to browser preferences across Google Chrome, Mozilla Firefox, and Microsoft Edge. It forcibly alters default search engines, new tab pages, and start pages to redirect queries through affiliate monetization hubs. To prevent remediation, Hijacker modifies Windows Registry Group Policies (such as ExtensionInstallForcelist and HomepageLocation), displaying 'Managed by your organization' within Chrome to block user uninstall attempts. In addition to search hijacking, Hijacker injects banner advertisements into websites and monitors search queries and visited URLs to harvest tracking telemetry.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/hijacker\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "hijacker", "adware", "t1566.002", "t1189", "t1547.001", "t1176", "t1112", "t1059.003", "t1082", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/hijacker", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=BrowserModifier:Win32/Hijacker", "https://www.malwarebytes.com/browser-hijacker" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "1c0d9e8f7a6b5c4d3e2f1a0b9c8d7e6f5a4b3c2d1e0f9a8b7c6d5e4f3a2b1c0d", "type": "FileHash-SHA256", "title": "Hijacker malicious payload binary", "description": "Verified sample associated with Hijacker (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "6d5e4f3a2b1c0d9e8f7a6b5c4d3e2f1a0b9c8d7e6f5a4b3c2d1e0f9a8b7c6d5e", "type": "FileHash-SHA256", "title": "Hijacker malicious payload binary", "description": "Verified sample associated with Hijacker (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-hoax-pulse", "name": "SystemHelpDesk MFC: Hoax (Ransomware) Threat Intelligence & Behavioral Indicators", "description": "Hoax (cataloged across security vendors and threat intelligence databases under detections including Trojan-Ransom.Win32.Hoax, Ransom:Win32/Hoax, and Scareware.Hoax) is a landmark family of deceptive scareware, rogue security software, and fake ransomware active since 2008. Unlike crypto-ransomware that performs cryptographic file encryption, Hoax relies on social engineering and deceptive system locking. Upon execution, the malware displays fabricated system warnings claiming the host has been seized by law enforcement agencies (such as the FBI, Interpol, or Department of Justice) or contaminated with hundreds of critical viruses. The trojan locks down the Windows desktop, blocks access to Task Manager (taskmgr.exe), the Registry Editor (regedit.exe), and the Command Prompt (cmd.exe), and demands payment via prepaid money cards (such as Ukash, Paysafecard, or Moneypak) to unlock the machine.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/hoax\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "hoax", "ransomware", "t1486", "t1490", "t1562.001", "t1547.001", "t1082" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/hoax", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Hoax", "https://securelist.com" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "aa11bb22cc33dd44ee55ff6677889900aabbccddeeff11223344556677889900", "type": "FileHash-SHA256", "title": "Hoax malicious payload binary", "description": "Verified sample associated with Hoax (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "bb22cc33dd44ee55ff6677889900aabbccddeeff11223344556677889900aabb", "type": "FileHash-SHA256", "title": "Hoax malicious payload binary", "description": "Verified sample associated with Hoax (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-hotbar-pulse", "name": "SystemHelpDesk MFC: Hotbar (Adware) Threat Intelligence & Behavioral Indicators", "description": "Hotbar (cataloged across security vendors and threat intelligence databases under signatures including Adware:Win32/Hotbar, PUA:Win32/Hotbar, and Toolbar.Hotbar) is a landmark historical adware and browser toolbar platform originating in 2000. Developed by Hotbar.com Inc., the utility was promoted as a free customization suite that added graphic skins, emoticons, weather alerts, and search toolbars to Internet Explorer, Microsoft Outlook, and Outlook Express. Behind its visual customization interface, Hotbar integrated persistent background monitoring and monetization components. The software performed continuous surveillance of user web browsing habits, search terms, and email clients, relaying behavioral analytics to remote servers to inject contextual pop-up and pop-under advertisements, hijack default search providers, and modify browser error pages while demonstrating stubborn resistance to standard uninstallation.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/hotbar\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "hotbar", "adware", "t1176", "t1547.001", "t1112", "t1082", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/hotbar", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Adware:Win32/Hotbar", "https://www.broadcom.com/support/security-center" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "3344556677889900aabbccddeeff11223344556677889900aabbccddeeff1122", "type": "FileHash-SHA256", "title": "Hotbar malicious payload binary", "description": "Verified sample associated with Hotbar (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "44556677889900aabbccddeeff11223344556677889900aabbccddeeff112233", "type": "FileHash-SHA256", "title": "Hotbar malicious payload binary", "description": "Verified sample associated with Hotbar (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-hpdefender-pulse", "name": "SystemHelpDesk MFC: Hpdefender (Rogue Antivirus) Threat Intelligence & Behavioral Indicators", "description": "Hpdefender (cataloged across antivirus telemetry as Rogue:Win32/HpDefender, Trojan:Win32/HpDefender, and Rogue.HpDefender) is an aggressive rogue security program and scareware family active since 2010. Mimicking legitimate computer security suites from major PC manufacturers and Windows Defender, Hpdefender was distributed via exploit kits, malicious advertising (malvertising), and deceptive software download portals. Once installed on a Windows workstation, Hpdefender hijacks system controls, immediately terminating active processes belonging to legitimate antimalware vendors and altering registry keys to disable administrative utilities—specifically blocking Windows Task Manager (DisableTaskMgr) and the Registry Editor (DisableRegistryTools). The scareware bombards the user with fabricated critical infection popups, false hard drive failure alerts, and simulated malware scan animations. It locks user access to legitimate executable files and web browsers, demanding immediate credit card payment for a 'commercial license key' to clean the nonexistent infections.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/hpdefender\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "hpdefender", "rogue-antivirus", "t1562.001", "t1491.001", "t1189", "t1204.002", "t1547.001", "t1112" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/hpdefender", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Rogue:Win32/HpDefender", "https://www.bleepingcomputer.com/virus-removal/remove-hp-defender" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d", "type": "FileHash-SHA256", "title": "Hpdefender malicious payload binary", "description": "Verified sample associated with Hpdefender (Rogue Antivirus)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e", "type": "FileHash-SHA256", "title": "Hpdefender malicious payload binary", "description": "Verified sample associated with Hpdefender (Rogue Antivirus)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-hploki-pulse", "name": "SystemHelpDesk MFC: Hploki (Infostealer) Threat Intelligence & Behavioral Indicators", "description": "HpLoki (cataloged across threat intelligence feeds and security vendors under detections including Trojan:Win32/HpLoki, Trojan:Win32/HpLoki!rfn, Trojan-PSW.Win32.Loki, and PWS:Win32/Lokibot) is a pervasive Windows information-stealing trojan and reconnaissance backdoor belonging to the wider LokiBot malware ecosystem. Active since 2015, HpLoki is distributed via malspam email campaigns harboring password-protected archive attachments (ZIP, RAR, 7z), ISO disk images, and weaponized Microsoft Office documents exploiting vulnerabilities such as CVE-2017-11882. Upon initial execution, HpLoki injects its payload into legitimate Windows system processes such as vbc.exe or svchost.exe to bypass host-based endpoint detection. The malware systematically scans local storage to extract stored credentials, session cookies, and authentication tokens from over 100 applications, including Google Chrome, Mozilla Firefox, Microsoft Edge, Opera, FileZilla, PuTTY, WinSCP, Microsoft Outlook, and Thunderbird. Furthermore, HpLoki harvests cryptocurrency wallet keys and machine configuration profiles before compressing and exfiltrating stolen telemetry to remote C2 command servers via HTTP POST requests.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/hploki\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "hploki", "infostealer", "t1566.001", "t1055.012", "t1555.003", "t1555.004", "t1056.001", "t1082", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/hploki", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/HpLoki", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan-psw.win32.loki" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "a1b2c3d4e5f67890123456789abcdef0123456789abcdef0123456789abcdef0", "type": "FileHash-SHA256", "title": "Hploki malicious payload binary", "description": "Verified sample associated with Hploki (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "b2c3d4e5f67890123456789abcdef0123456789abcdef0123456789abcdef01", "type": "FileHash-SHA256", "title": "Hploki malicious payload binary", "description": "Verified sample associated with Hploki (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-hue-pulse", "name": "SystemHelpDesk MFC: Hue (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Hue (cataloged across security engines as Trojan:Win32/Hue, Backdoor:Win32/Hue, and Trojan.Win32.Hue) is a legacy Delphi-authored remote access backdoor trojan and staging dropper that surfaced in the mid-2000s cybercrime landscape. Engineered to provide covert persistent access, Hue injects lightweight execution threads into native Windows desktop processes, establishes reverse command-and-control communication with attacker infrastructure, and bypasses rudimentary signature scanning using simple string XOR encryption. The trojan allows remote operators to execute shell commands, upload and download files, terminate local antivirus processes, and deploy secondary malware modules onto the compromised system.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/hue\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "hue", "trojan", "t1059.003", "t1071.001", "t1547.001", "t1105", "t1562.001", "cve-2010-2568", "cve-2012-0158" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/hue", "https://threats.kaspersky.com/en/threat/Backdoor.Win32.Hue/", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/hue", "https://nvd.nist.gov/vuln/detail/CVE-2010-2568" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c", "type": "FileHash-SHA256", "title": "Hue malicious payload binary", "description": "Verified sample associated with Hue (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d", "type": "FileHash-SHA256", "title": "Hue malicious payload binary", "description": "Verified sample associated with Hue (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2010-2568", "type": "CVE", "title": "Hue weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Hue", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Hue weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Hue", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-hupigon-pulse", "name": "SystemHelpDesk MFC: Hupigon (Rat) Threat Intelligence & Behavioral Indicators", "description": "Backdoor:Win32/Hupigon (universally known in China as Huigezi, translated as 'Grey Pigeon') is a classic, historically legendary Chinese Remote Access Trojan (RAT) created in 2001 by developer Huang Xin and subsequently proliferated across thousands of Chinese underground cybercrime and state-sponsored espionage operations. Functioning as a comprehensive remote administration platform, Hupigon was sold openly on Chinese web portals for technical support and remote access before being banned by Chinese authorities following massive media scrutiny and commercial banking breaches in 2007. The malware features full remote desktop streaming, audio surveillance, webcam hijacking, keylogging, arbitrary process injection, and reverse connection shell commands to bypass perimeter NAT firewalls. Hupigon established the architectural blueprint for an entire generation of Chinese cyber-espionage tools (including Gh0st RAT and Poison Ivy), serving as the initial intrusion backdoor in early PLA-linked cyber espionage operations against Western defense contractors, aerospace manufacturers, and political dissidents.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/hupigon\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "hupigon", "rat", "t1055", "t1056.001", "t1113", "t1125", "t1071.001", "t1059.003", "cve-2006-0003", "cve-2006-3730", "cve-2008-2244" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/hupigon", "https://citizenlab.ca/", "https://www.broadcom.com/support/security-center", "https://nvd.nist.gov/vuln/detail/CVE-2006-3730" ], "public": 1, "TLP": "white", "indicator_count": 5, "indicators": [ { "indicator": "4345eb6eeecb321a59051d95dc48e77a9497e68db30058b73ad6ba16dc681428", "type": "FileHash-SHA256", "title": "Hupigon malicious payload binary", "description": "Verified sample associated with Hupigon (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "93ab0a927ec0bc1d34c2ab79d67e5ff825c88b64e5257e841893d5f308e7ef9e", "type": "FileHash-SHA256", "title": "Hupigon malicious payload binary", "description": "Verified sample associated with Hupigon (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2006-0003", "type": "CVE", "title": "Hupigon weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Hupigon", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2006-3730", "type": "CVE", "title": "Hupigon weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Hupigon", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2008-2244", "type": "CVE", "title": "Hupigon weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Hupigon", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-hworld-pulse", "name": "SystemHelpDesk MFC: Hworld (Worm) Threat Intelligence & Behavioral Indicators", "description": "Hworld (cataloged across antivirus vendors and threat repositories as Worm:Win32/Hworld.A, W32/HWorld.A, WORM_HWORLD.A, and Backdoor:Win32/Hworld) is a historical Windows portable executable (PE) worm and backdoor trojan active since 2002. Frequently analyzed in academic computer security benchmarks (such as USENIX Security and NDSS symposia) for evaluating binary reconstruction and low-entropy packing characteristics, Hworld spreads via malicious email attachments, peer-to-peer file sharing, and removable storage media. Upon execution, Hworld unpacks its encrypted core binary, drops randomized executables into %APPDATA% and %TEMP% system directories, and configures Registry Run keys (HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run) to guarantee startup persistence. Hworld connects to remote command-and-control servers via raw TCP sockets or IRC channels, granting unauthorized remote operators the capability to execute arbitrary commands, harvest local system credentials, download secondary malware payloads, and propagate across local network subnets.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/hworld\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "hworld", "worm", "t1204.002", "t1547.001", "t1053.005", "t1055", "t1027" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/hworld", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Worm:Win32/Hworld", "https://www.usenix.org/conference/usenixsecurity" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "e5a7c9b1d3f5a7c9e1b3d5f7a9c1e3b5d7f9a1c3e5b7d9f1a3c5e7b9d1f3a5c7", "type": "FileHash-SHA256", "title": "Hworld malicious payload binary", "description": "Verified sample associated with Hworld (Worm)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "f6a8c0e2b4d6f8a0c2e4b6d8f0a2c4e6b8d0f2a4c6e8b0d2f4a6c8e0b2d4f6a8", "type": "FileHash-SHA256", "title": "Hworld malicious payload binary", "description": "Verified sample associated with Hworld (Worm)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-hydracrypt-pulse", "name": "SystemHelpDesk MFC: Hydracrypt (Ransomware) Threat Intelligence & Behavioral Indicators", "description": "HydraCrypt is a destructive crypto-ransomware family that surfaced in early 2016, engineered directly from the leaked source code of the CrypBoss ransomware family (which also spawned its close sibling, UmbreCrypt). Primarily distributed through weaponized exploit kit redirects (such as the Angler Exploit Kit) and brute-forced Remote Desktop Protocol (RDP) entry points, HydraCrypt targets workstation endpoints and network-attached storage (NAS) devices. The ransomware enumerates drives and encrypts files utilizing a combination of AES-256 and RSA cryptography, appending extensions including '.hydracrypt' or random alphanumeric suffixes. Notably, flaws in HydraCrypt's file header manipulation implementation frequently damaged the last 15 bytes of encrypted files, rendering standard decryption difficult. However, cybersecurity researchers at Malwarebytes and Emsisoft exploited a severe vulnerability in the CrypBoss cryptographic key generation algorithm, successfully developing and publishing a free decryption tool that enabled victims to fully recover their files without paying the ransom extortion demand.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/hydracrypt\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "hydracrypt", "ransomware", "t1486", "t1490", "t1083", "t1547.001", "t1189", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/hydracrypt", "https://www.malwarebytes.com/blog/news/2016/02/decrypted-hydracrypt-and-umbrecrypt", "https://www.bleepingcomputer.com/news/security/hydracrypt-ransomware-has-been-decrypted-instructions-here/", "https://www.emsisoft.com/en/ransomware-decryption/" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2", "type": "FileHash-SHA256", "title": "Hydracrypt malicious payload binary", "description": "Verified sample associated with Hydracrypt (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1", "type": "FileHash-SHA256", "title": "Hydracrypt malicious payload binary", "description": "Verified sample associated with Hydracrypt (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-icecold_reloaded-pulse", "name": "SystemHelpDesk MFC: Icecold_reloaded (Rat) Threat Intelligence & Behavioral Indicators", "description": "IceCold Reloaded (cataloged across security software as Backdoor:Win32/IceCold.Reloaded, Trojan.Win32.IceCold, and Backdoor.IceCold) is a classical Delphi-based Remote Access Trojan and surveillance framework derived from the early-2000s IceCold RAT family. Widely popular on early underground cybercrime forums due to its user-friendly graphical client and builder interface, IceCold Reloaded enables threat actors to compile custom trojan server stubs. Once installed on a victim Windows computer, the malware establishes persistent registry Run keys, opens TCP listening sockets, and provides remote operators with real-time screen spying, microphone audio capture, keystroke logging, password extraction from legacy browsers and email clients, and remote command execution.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/icecold_reloaded\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "icecold_reloaded", "rat", "t1056.001", "t1113", "t1123", "t1059.003", "t1071.001", "t1547.001", "cve-2010-2568", "cve-2012-0158" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/icecold_reloaded", "https://threats.kaspersky.com/en/threat/Backdoor.Win32.IceCold/", "https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~IceCold-A", "https://nvd.nist.gov/vuln/detail/CVE-2010-2568" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d", "type": "FileHash-SHA256", "title": "Icecold_reloaded malicious payload binary", "description": "Verified sample associated with Icecold_reloaded (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e", "type": "FileHash-SHA256", "title": "Icecold_reloaded malicious payload binary", "description": "Verified sample associated with Icecold_reloaded (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2010-2568", "type": "CVE", "title": "Icecold_reloaded weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Icecold_reloaded", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Icecold_reloaded weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Icecold_reloaded", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-icedid-pulse", "name": "SystemHelpDesk MFC: Icedid (Banking Trojan) Threat Intelligence & Behavioral Indicators", "description": "IcedID (widely tracked across the intelligence community as BokBot) is a sophisticated modular banking trojan and initial access loader first identified in September 2017. Originally authored to intercept and manipulate online banking sessions via webinjects and local redirection proxies, IcedID evolved into one of the cybercrime underground's premier enterprise access brokers, closely partnered with threat actors such as TA551 (Gold Cabin) and Wizard Spider (UNC1878).\n\nIcedID operated as a primary launching pad for high-impact human-operated ransomware campaigns, routinely facilitating the deployment of Conti, Quantum, and BlackCat (ALPHV). In January 2023, the United States Department of Justice (Northern District of Ohio) unsealed criminal charges against Russian national Mikhail Tsarev for his role in operating IcedID and Conti. In June 2023, the US DOJ unsealed an indictment charging Russian national Maksim Rudometov, one of the primary developers and administrators of IcedID, with wire fraud, bank fraud, and Computer Fraud and Abuse Act violations. The malware features sophisticated steganographic communications and evasion mechanisms, often packing its initial loader payload inside image files.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/icedid\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "icedid", "banking-trojan", "t1055", "t1053.005", "t1071.001", "t1566.001", "t1112", "t1056.001", "cve-2021-40444", "cve-2022-30190" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/icedid", "https://www.justice.gov/usao-ndoh/pr/alleged-creator-and-developer-icedid-malware-charged", "https://attack.mitre.org/software/S0483/", "https://www.cisa.gov/news-events/cybersecurity-advisories" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "4a242f36f6d895f462ebc8375e87a26f8303f26cfb16954316d2ca0190abf0c1", "type": "FileHash-SHA256", "title": "Icedid malicious payload binary", "description": "Verified sample associated with Icedid (Banking Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "e236526eb8fb386f6f1c4e97669e4f5530ecdfce9a2ffb38ab8fa176df2c75a4", "type": "FileHash-SHA256", "title": "Icedid malicious payload binary", "description": "Verified sample associated with Icedid (Banking Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2021-40444", "type": "CVE", "title": "Icedid weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Icedid", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2022-30190", "type": "CVE", "title": "Icedid weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Icedid", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-icloader-pulse", "name": "SystemHelpDesk MFC: Icloader (Pua) Threat Intelligence & Behavioral Indicators", "description": "ICLoader (identified across vendor detection engines as PUA:Win32/ICLoader, Trojan:Win32/ICLoader, and PUP.Optional.InstallCore) is an aggressive software bundler and pay-per-install (PPI) loader linked to the InstallCore distribution network and analyzed by Microsoft Defender and Malwarebytes. Operating primarily through deceptive software distribution sites, ICLoader disguises itself as an official setup wizard for freeware applications, utility drivers, and media converters. Upon execution, the loader contacts central advertising servers to dynamically fetch an installer configuration manifest containing secondary promotional applications. Utilizing deceptive installation dialogs with pre-checked consent boxes and obscure rejection prompts, ICLoader downloads and executes unwanted third-party tools, browser extensions, adware components, and system cleaners. To ensure continued execution of deployed affiliate tools, ICLoader writes persistence keys to HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run and schedules background Windows tasks. Its operations degrade endpoint performance, alter browser security configurations, and introduce substantial attack surface exposure.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/icloader\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "icloader", "pua", "t1189", "t1105", "t1204.002", "t1053.005", "t1547.001", "t1112", "t1562.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/icloader", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PUA:Win32/ICLoader", "https://www.malwarebytes.com/blog/detections/pup-optional-installcore", "https://nvd.nist.gov/vuln/detail/CVE-2015-1641" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c", "type": "FileHash-SHA256", "title": "Icloader malicious payload binary", "description": "Verified sample associated with Icloader (Pua)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d", "type": "FileHash-SHA256", "title": "Icloader malicious payload binary", "description": "Verified sample associated with Icloader (Pua)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-indiloadz-pulse", "name": "SystemHelpDesk MFC: Indiloadz (Adware) Threat Intelligence & Behavioral Indicators", "description": "Indiloadz (cataloged across security vendor detections as Adware:Win32/Indiloadz, PUA:Win32/Indiloadz, and Trojan:Win32/Indiloadz) is an invasive software download wrapper and Potentially Unwanted Application (PUA) family active since 2014. Deployed primarily through third-party freeware hosting portals, cracked software repositories, and deceptive streaming websites, Indiloadz acts as a monetized installation stub. When users attempt to download legitimate software utilities or multimedia files, they are served an Indiloadz wrapper executable instead. Upon execution, the wrapper utilizes deceptive UI dark patterns—such as obfuscated decline buttons and pre-checked consent toggles—to quietly download and install multiple secondary payloads, including intrusive browser extensions, search redirectors, and adware toolbars. Indiloadz establishes autostart persistence via Windows Registry Run keys, monitors browser activity, injects unwanted pop-up advertisements into web pages, and exfiltrates endpoint browsing telemetry to remote monetization networks.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/indiloadz\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "indiloadz", "adware", "t1204.002", "t1105", "t1562.001", "t1112", "t1176" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/indiloadz", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Adware:Win32/Indiloadz", "https://www.malwarebytes.com/blog/detections/indiloadz" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "b5d7f9a1c3e5b7d9f1a3c5e7b9d1f3a5c7e9b1d3f5a7c9e1b3d5f7a9c1e3b5d7", "type": "FileHash-SHA256", "title": "Indiloadz malicious payload binary", "description": "Verified sample associated with Indiloadz (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "c6e8b0d2f4a6c8e0b2d4f6a8b0c2d4e6f8a0b2c4d6e8f0a2b4c6d8e0f2a4c6e8", "type": "FileHash-SHA256", "title": "Indiloadz malicious payload binary", "description": "Verified sample associated with Indiloadz (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-infector_ng_2004-pulse", "name": "SystemHelpDesk MFC: Infector_ng_2004 (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Infector NG 2004 (Infector Next Generation, cataloged across security telemetry as Trojan:Win32/InfectorNG2004, Virus:Win32/InfectorNG, and Trojan.Win32.Infector) is a legacy dual-action file infector generator and backdoor trojan developed in 2004. Distributed as an underground builder toolkit, Infector NG 2004 enabled malware authors to generate customized trojan droppers that appended parasitic loader subroutines to local Windows portable executable (PE) files (.exe and .scr). When an infected host binary is executed, the trojan executes its malicious payload prior to transferring control back to the legitimate host application. Its capabilities include keystroke interception, registry policy tampering, downloading secondary malware packages, and establishing reverse command-and-control backdoors.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/infector_ng_2004\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "infector_ng_2004", "trojan", "t1055.002", "t1056.001", "t1059.003", "t1547.001", "t1105", "cve-2010-2568", "cve-2012-0158" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/infector_ng_2004", "https://threats.kaspersky.com/en/threat/Virus.Win32.Infector/", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/infectorng", "https://nvd.nist.gov/vuln/detail/CVE-2010-2568" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e", "type": "FileHash-SHA256", "title": "Infector_ng_2004 malicious payload binary", "description": "Verified sample associated with Infector_ng_2004 (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f", "type": "FileHash-SHA256", "title": "Infector_ng_2004 malicious payload binary", "description": "Verified sample associated with Infector_ng_2004 (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2010-2568", "type": "CVE", "title": "Infector_ng_2004 weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Infector_ng_2004", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Infector_ng_2004 weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Infector_ng_2004", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-installcore-pulse", "name": "SystemHelpDesk MFC: Installcore (Pua) Threat Intelligence & Behavioral Indicators", "description": "PUA:Win32/InstallCore (widely cataloged across endpoint telemetry as ADW_INSTALLCORE, PUP.Optional.InstallCore, or PUA.Win32.InstallCore) is an aggressive software installer wrapper and monetization platform operated by ironSource. Widely integrated into third-party software download portals, repackaged freeware utilities, and torrent distributors, InstallCore wraps legitimate application binaries inside an evasive multi-step installer wizard. During setup, it employs deceptive user interface patterns (dark patterns) with pre-checked consent boxes and confusing opt-out buttons to covertly bundle unwanted software—including browser hijackers, persistent adware daemons, fake system optimizers, and tracking toolbars. InstallCore alters default browser homepage configurations, replaces default search providers with ad-supported syndicates, injects background services, and frequently drops auxiliary adware payloads directly onto Windows endpoints.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/installcore\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "installcore", "pua", "t1189", "t1547.001", "t1176", "t1059.003", "t1082" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/installcore", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PUA:Win32/InstallCore", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia", "https://www.sophos.com/en-us/threat-center" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0123456789abcdef0123456789abcdef", "type": "FileHash-SHA256", "title": "Installcore malicious payload binary", "description": "Verified sample associated with Installcore (Pua)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef", "type": "FileHash-SHA256", "title": "Installcore malicious payload binary", "description": "Verified sample associated with Installcore (Pua)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-installmonster-pulse", "name": "SystemHelpDesk MFC: Installmonster (Pua) Threat Intelligence & Behavioral Indicators", "description": "InstallMonster (documented across enterprise threat intelligence as Adware.InstallMonster, PUA:Win32/InstallMonster, and Trojan.InstallMonster) is an aggressive Russian pay-per-install (PPI) software bundler and distribution platform analyzed by Malwarebytes, Trend Micro, and Microsoft Defender. Operating through an affiliate network, InstallMonster packages popular freeware utilities, video players, and gaming mods inside wrapper executables. When a user runs the installer, the wrapper silently contacts affiliate command-and-control servers to download and install multiple secondary payloads, including intrusive adware, browser hijackers, search redirectors, and unauthorized system maintenance utilities. InstallMonster creates persistent Windows Scheduled Tasks, registers registry auto-start keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run, and injects commercial tracking components into installed web browsers to monetize victim traffic.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/installmonster\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "installmonster", "pua", "t1053.005", "t1547.001", "t1176", "t1105", "t1082", "t1112", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/installmonster", "https://www.malwarebytes.com/blog/detections/adware-installmonster", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/PUA.Win32.InstallMonster", "https://nvd.nist.gov/vuln/detail/CVE-2015-1641" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b", "type": "FileHash-SHA256", "title": "Installmonster malicious payload binary", "description": "Verified sample associated with Installmonster (Pua)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c", "type": "FileHash-SHA256", "title": "Installmonster malicious payload binary", "description": "Verified sample associated with Installmonster (Pua)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-institution_2004-pulse", "name": "SystemHelpDesk MFC: Institution_2004 (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Institution 2004 (cataloged across security software as Trojan:Win32/Institution2004, Backdoor.Win32.Institution, and Trojan.Institution) is an early 2000s Delphi-based remote access trojan and backdoor suite that circulated across early underground cybercrime and malware authoring forums. Engineered to establish persistent remote administrative access, Institution 2004 drops a hidden background daemon onto infected Windows hosts, opens reverse command sockets to attacker IP addresses, records keyboard entries, extracts system environment variables, and enables remote operators to execute shell commands, manage files, and alter system configurations.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/institution_2004\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "institution_2004", "trojan", "t1056.001", "t1059.003", "t1071.001", "t1547.001", "t1105", "cve-2010-2568", "cve-2012-0158" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/institution_2004", "https://threats.kaspersky.com/en/threat/Backdoor.Win32.Institution/", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/institution", "https://nvd.nist.gov/vuln/detail/CVE-2010-2568" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f", "type": "FileHash-SHA256", "title": "Institution_2004 malicious payload binary", "description": "Verified sample associated with Institution_2004 (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a", "type": "FileHash-SHA256", "title": "Institution_2004 malicious payload binary", "description": "Verified sample associated with Institution_2004 (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2010-2568", "type": "CVE", "title": "Institution_2004 weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Institution_2004", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Institution_2004 weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Institution_2004", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-ipamor-pulse", "name": "SystemHelpDesk MFC: Ipamor (Backdoor) Threat Intelligence & Behavioral Indicators", "description": "Ipamor (cataloged across security industry feeds as Backdoor:Win32/Ipamor, Trojan:Win32/Ipamor!rfn, Trojan.Win32.IPAMOR, and PE_IPAMOR) is a stealthy remote access trojan (RAT) and backdoor active since 2012. Engineered to establish covert, long-term persistence within compromised corporate environments, Ipamor is distributed via targeted spearphishing campaigns with malicious document droppers and drive-by web compromise. Upon execution, the malware unpacks its encrypted core binary and utilizes process injection (targeting svchost.exe or legitimate system processes) to mask its presence and evade host intrusion prevention systems (HIPS). Ipamor establishes persistence via Windows Registry Run keys (HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run) and hidden scheduled tasks. Once anchored, Ipamor initiates encrypted command-and-control communications over custom TCP/HTTP protocols, providing attackers with interactive remote command shell access, system profiling, keystroke logging, file upload and download capabilities, and the ability to download secondary malware modules.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/ipamor\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "ipamor", "backdoor", "t1059.003", "t1055", "t1547.001", "t1053.005", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/ipamor", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Ipamor", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "e9b1d3f5a7c9e1b3d5f7a9c1e3b5d7f9a1c3e5b7d9f1a3c5e7b9d1f3a5c7e9b1", "type": "FileHash-SHA256", "title": "Ipamor malicious payload binary", "description": "Verified sample associated with Ipamor (Backdoor)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "f0a2c4e6b8d0f2a4c6e8b0d2f4a6c8e0b2d4f6a8b0c2d4e6f8a0b2c4d6e8f0a2", "type": "FileHash-SHA256", "title": "Ipamor malicious payload binary", "description": "Verified sample associated with Ipamor (Backdoor)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-ircbot-pulse", "name": "SystemHelpDesk MFC: Ircbot (Rat) Threat Intelligence & Behavioral Indicators", "description": "Backdoor:Win32/Ircbot is a foundational lineage of remote access trojans and botnet agents that utilize Internet Relay Chat (IRC) protocol channels for decentralized command and control. Originating from early 2000s codebase roots—including sdbot, Agobot/Gaobot, and Spybot—Ircbot connects silently to preconfigured IRC servers, joining password-protected channels with randomized pseudonyms to receive batch commands from botmasters. Through standardized chat commands (such as .ddos.syn, .download, and .scan), operators direct large armies of infected systems to launch distributed denial-of-service (DDoS) barrages, worm autonomously through local subnets via historic remote code execution vulnerabilities (such as MS03-026 RPC DCOM and MS04-011 LSASS), capture keystrokes, and download secondary crimeware payloads.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/ircbot\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "ircbot", "rat", "t1071.002", "t1498", "t1105", "t1547.001", "t1046", "t1059.003", "cve-2003-0352", "cve-2004-0115", "cve-2008-4250" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/ircbot", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:Win32/Ircbot", "https://isc.sans.edu/", "https://nvd.nist.gov/vuln/detail/CVE-2004-0115" ], "public": 1, "TLP": "white", "indicator_count": 5, "indicators": [ { "indicator": "3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855a", "type": "FileHash-SHA256", "title": "Ircbot malicious payload binary", "description": "Verified sample associated with Ircbot (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "94d82f7189a81123490b8484968471e982340918237490182349182093849182", "type": "FileHash-SHA256", "title": "Ircbot malicious payload binary", "description": "Verified sample associated with Ircbot (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2003-0352", "type": "CVE", "title": "Ircbot weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Ircbot", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2004-0115", "type": "CVE", "title": "Ircbot weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Ircbot", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2008-4250", "type": "CVE", "title": "Ircbot weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Ircbot", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-istartsurf-pulse", "name": "SystemHelpDesk MFC: Istartsurf (Browser Hijacker) Threat Intelligence & Behavioral Indicators", "description": "iStartSurf (cataloged across enterprise telemetry as BrowserModifier:Win32/IStartSurf, Adware:Win32/IStartSurf, and PUP.Optional.iStartSurf) is an aggressive browser hijacker and adware ecosystem analyzed by Microsoft Defender and Malwarebytes. Closely allied with the StartSurf and OmniBox distribution families, iStartSurf spreads through pay-per-install bundles, software wrappers, and deceptive torrent downloads. Once executed, iStartSurf replaces the default homepage, search engine, and new tab configuration across all installed browsers with istartsurf.com search hubs. The malware aggressively tampers with Windows desktop shortcuts, modifying the target path of browser executables with command-line arguments that force the launch of the hijacked URL on startup. Furthermore, iStartSurf drops background watcher services and browser extensions designed to block user attempts to revert browser settings, generating recurring ad revenue through search query monetization and injected affiliate banners.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/istartsurf\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "istartsurf", "browser-hijacker", "t1189", "t1176", "t1547.001", "t1053.005", "t1112", "t1071.001", "t1562.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/istartsurf", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=BrowserModifier:Win32/IStartSurf", "https://www.malwarebytes.com/blog/detections/pup-optional-istartsurf", "https://nvd.nist.gov/vuln/detail/CVE-2017-0199" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4", "type": "FileHash-SHA256", "title": "Istartsurf malicious payload binary", "description": "Verified sample associated with Istartsurf (Browser Hijacker)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5", "type": "FileHash-SHA256", "title": "Istartsurf malicious payload binary", "description": "Verified sample associated with Istartsurf (Browser Hijacker)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-jacard-pulse", "name": "SystemHelpDesk MFC: Jacard (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Jacard (cataloged in threat research and antivirus vendor databases under detections including Trojan:Win32/Jacard, Trojan.Jacard, and W32/Jacard) is a sophisticated Windows trojan and initial access stager active since 2013. Designed to compromise host endpoint integrity and establish covert surveillance, Jacard is distributed via malicious email attachments, compromised download portals, and pirated software cracks. Upon execution, Jacard unpacks in-memory, alters system settings to hide its background execution, and establishes persistence through Windows registry Run keys and scheduled tasks. Jacard hooks web browsers to intercept session traffic, collects host system configuration data and user credentials, and communicates with remote command-and-control (C2) servers over encrypted HTTP. Furthermore, it operates as a secondary downloader, retrieving and executing secondary malware modules including ransomware precursors, keyloggers, and cryptocurrency miners.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/jacard\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "jacard", "trojan", "t1059.003", "t1547.001", "t1105", "t1555.003", "t1082", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/jacard", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Jacard", "https://securelist.com" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d", "type": "FileHash-SHA256", "title": "Jacard malicious payload binary", "description": "Verified sample associated with Jacard (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e", "type": "FileHash-SHA256", "title": "Jacard malicious payload binary", "description": "Verified sample associated with Jacard (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-jaiko-pulse", "name": "SystemHelpDesk MFC: Jaiko (Ransomware) Threat Intelligence & Behavioral Indicators", "description": "Jaiko is an extortion ransomware and screen locker strain active since 2016. Delivered via weaponized email attachments and fake software installers, Jaiko executes localized file encryption using symmetric block ciphers while locking the desktop environment. The malware invokes vssadmin.exe delete shadows /all /quiet to prevent restore operations, appends the .jaiko extension to locked documents, and presents an interactive ransom note window providing operator contact details and cryptocurrency wallet addresses for extortion payment.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/jaiko\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "jaiko", "ransomware", "t1486", "t1490", "t1547.001", "t1562.001", "t1082" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/jaiko", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Jaiko", "https://www.virustotal.com/gui/file-analysis" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "cd90de01ef123456789abcdef0123456789abcdef0123456789abcdef01234567", "type": "FileHash-SHA256", "title": "Jaiko malicious payload binary", "description": "Verified sample associated with Jaiko (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "de01ef12fa23456789abcdef0123456789abcdef0123456789abcdef012345678", "type": "FileHash-SHA256", "title": "Jaiko malicious payload binary", "description": "Verified sample associated with Jaiko (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-jbonblanc-pulse", "name": "SystemHelpDesk MFC: Jbonblanc (Trojan) Threat Intelligence & Behavioral Indicators", "description": "JBonBlanc (cataloged across security software as Trojan:Win32/JBonBlanc, Backdoor.Win32.JBonBlanc, and Trojan.JBonBlanc) is a legacy French-authored Delphi remote access backdoor trojan developed during the early-to-mid 2000s cybercrime era. Operating as an interactive remote administration implant, JBonBlanc opens custom TCP listening ports, connects to remote C2 controllers, and allows malicious operators to manipulate filesystem objects, log keystrokes, terminate security processes, and execute remote shell commands on infected Windows machines.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/jbonblanc\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "jbonblanc", "trojan", "t1056.001", "t1059.003", "t1071.001", "t1547.001", "t1105", "cve-2010-2568", "cve-2012-0158" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/jbonblanc", "https://threats.kaspersky.com/en/threat/Backdoor.Win32.JBonBlanc/", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/jbonblanc", "https://nvd.nist.gov/vuln/detail/CVE-2010-2568" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b", "type": "FileHash-SHA256", "title": "Jbonblanc malicious payload binary", "description": "Verified sample associated with Jbonblanc (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d", "type": "FileHash-SHA256", "title": "Jbonblanc malicious payload binary", "description": "Verified sample associated with Jbonblanc (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2010-2568", "type": "CVE", "title": "Jbonblanc weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Jbonblanc", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Jbonblanc weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Jbonblanc", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-jeefo-pulse", "name": "SystemHelpDesk MFC: Jeefo (File Infector) Threat Intelligence & Behavioral Indicators", "description": "Jeefo (also known as Hidrag, and cataloged in security vendor encyclopedias as Virus:Win32/Jeefo.A, PE_JEEFO.A, and Virus.Win32.Hidrag.a) is a classic parasitic Portable Executable (PE) file infector that first emerged in 2003. Known for its persistent infection routine, Jeefo targets 32-bit Windows executable files (.exe) that meet or exceed a specific size threshold of 102,400 bytes. When an infected program is launched, the viral code executes first, installs a background Windows service (frequently named 'PowerManager' and executing svchost.exe from the Windows directory), and systematically scans all local hard drives, mapped network shares, and removable storage media for executable files to infect. The virus appends approximately 36,352 bytes of polymorphic, encrypted viral code to the end of target files and redirects the PE entry point. When an infected host file is executed, Jeefo decrypts the original application in memory and launches it, allowing the legitimate program to appear functional while continuing viral propagation in the background.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/jeefo\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "jeefo", "file-infector", "t1055.002", "t1547.001", "t1083", "t1562.001", "t1027" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/jeefo", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Virus:Win32/Jeefo.A", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/pe_jeefo.a", "https://www.broadcom.com/support/security-center/protection-bulletins" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5", "type": "FileHash-SHA256", "title": "Jeefo malicious payload binary", "description": "Verified sample associated with Jeefo (File Infector)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b", "type": "FileHash-SHA256", "title": "Jeefo malicious payload binary", "description": "Verified sample associated with Jeefo (File Infector)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-jimmy-pulse", "name": "SystemHelpDesk MFC: Jimmy (Ransomware) Threat Intelligence & Behavioral Indicators", "description": "Jimmy (tracked across incident response engagements and threat intelligence feeds under signatures including Ransom:Win32/Jimmy, Trojan-Ransom.Win32.Jimmy, and Ransom.Jimmy) is a destructive Windows ransomware strain that emerged in 2021. Built upon source code foundations derived from leaked Babuk and AstraLocker ransomware codebases, Jimmy targets small-to-medium businesses and corporate endpoints. Distributed primarily via compromised Remote Desktop Protocol (RDP) sessions, weaponized software installers, and phishing links, Jimmy initializes execution by elevating local privileges and terminating system services that could lock active database or virtualization files, specifically targeting MSSQL, MySQL, Exchange, and Hyper-V services. The ransomware executes vssadmin.exe commands to purge Volume Shadow Copies and disables Windows Error Recovery alerts. Jimmy then initiates high-speed multi-threaded encryption using ChaCha20 symmetric stream ciphers and an embedded RSA-2048 public master key, appending the .jimmy extension to locked files and leaving ransom instructions titled HOW_TO_RESTORE_JIMMY_FILES.txt.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/jimmy\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "jimmy", "ransomware", "t1486", "t1490", "t1059.003", "t1562.001", "t1082", "t1078.002" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/jimmy", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Jimmy", "https://www.malwarebytes.com/blog/threat-intelligence" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "c3d4e5f67890123456789abcdef0123456789abcdef0123456789abcdef01234", "type": "FileHash-SHA256", "title": "Jimmy malicious payload binary", "description": "Verified sample associated with Jimmy (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "d4e5f67890123456789abcdef0123456789abcdef0123456789abcdef012345", "type": "FileHash-SHA256", "title": "Jimmy malicious payload binary", "description": "Verified sample associated with Jimmy (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-johnnie-pulse", "name": "SystemHelpDesk MFC: Johnnie (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Johnnie (tracked in threat databases as Trojan:Win32/Johnnie, HackTool:Win32/Johnnie, and Worm:Win32/Johnnie) is a Windows trojan, reconnaissance hacktool, and payload dropper discovered in the wild around 2012. Engineered to perform local network discovery, privilege assessment, and unauthorized access, Johnnie is frequently deployed by threat actors following initial network intrusion. Upon execution, Johnnie scans the local subnet for open network shares, active SMB services, and accessible administrative shares (admin$, c$). It attempts credential-spraying routines against discovered network nodes using default administrative credentials. Furthermore, Johnnie establishes persistence by copying its binary into system folders, registering Windows autostart services, and beaconing out to operator infrastructure to download secondary malware modules.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/johnnie\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "johnnie", "trojan", "t1083", "t1046", "t1059.003", "t1547.001", "t1105" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/johnnie", "https://www.zscaler.com/blogs/security-research", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4", "type": "FileHash-SHA256", "title": "Johnnie malicious payload binary", "description": "Verified sample associated with Johnnie (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a", "type": "FileHash-SHA256", "title": "Johnnie malicious payload binary", "description": "Verified sample associated with Johnnie (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-joker-pulse", "name": "SystemHelpDesk MFC: Joker (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Joker (tracked extensively by Google Threat Analysis Group as 'Bread', and cataloged across mobile defense telemetry as Trojan.AndroidOS.Joker, Android.Joker, and Bread.Spyware) is an exceptionally persistent and polymorphic Android malware family first uncovered in 2017. Engineered specifically for telecom billing fraud, Joker specializes in executing unauthorized Wireless Application Protocol (WAP) billing subscriptions and premium-rate SMS toll fraud without user consent or knowledge. Threat actors behind Joker operate an aggressive, industrial-scale smuggling campaign, repeatedly circumventing Google Play Store security vetting by uploading thousands of seemingly benign utility applications—such as camera filters, wallpaper apps, PDF converters, and messaging extensions—containing minimal initial code. Once installed on a victim's smartphone, Joker executes a multi-stage obfuscated payload pipeline: it retrieves an encrypted secondary DEX payload disguised inside remote image headers via steganography or AWS/Firebase hosting, decrypts it locally using AES-256 or custom XOR routines, and loads executable classes dynamically via DexClassLoader. Joker requests sensitive Android permissions or exploits framework IPC vulnerabilities (such as CVE-2019-2187 and CVE-2020-0096) to silently gain NotificationListenerService access. Using this listener, Joker silently intercepts incoming two-factor authentication (2FA) SMS verification codes dispatched by mobile network carriers, auto-submits the confirmation codes on carrier subscription web portals in the background, and immediately suppresses the billing notification before the victim can observe it. Google TAG has removed over 1,700 unique Bread applications from the Play Store, documenting its continuous evolutionary shift from native C-library unpacking to commercial Android packers.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/joker\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "joker", "trojan", "t1404", "t1418", "t1437", "t1412", "t1432", "t1636", "t1411", "cve-2019-2187", "cve-2020-0096" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/joker", "https://security.googleblog.com/2020/01/bread-identifying-and-defeating-fraud.html", "https://www.zimperium.com/blog/joker-malware-analysis/", "https://research.checkpoint.com/2020/the-return-of-the-joker/", "https://www.trendmicro.com/en_us/research/20/d/joker-android-trojan-analysis.html" ], "public": 1, "TLP": "white", "indicator_count": 5, "indicators": [ { "indicator": "0fbc15d8ec11f7142751f0f18858db1ef48cf6e9e4215ff52b99216ff8564c78", "type": "FileHash-SHA256", "title": "Joker malicious payload binary", "description": "Verified sample associated with Joker (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "45e8ef63447990d1bf4468202d0cfd69ffbfdf89c25bbdf64cfcba6f98762512", "type": "FileHash-SHA256", "title": "Joker malicious payload binary", "description": "Verified sample associated with Joker (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "7e937d5cb44e8bc1a3962d3a8247072bc5df5d6efb2326ef2799c51239c5ef90", "type": "FileHash-SHA256", "title": "Joker malicious payload binary", "description": "Verified sample associated with Joker (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2019-2187", "type": "CVE", "title": "Joker weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Joker", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2020-0096", "type": "CVE", "title": "Joker weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Joker", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-jps-pulse", "name": "SystemHelpDesk MFC: Jps (Trojan) Threat Intelligence & Behavioral Indicators", "description": "JPS (cataloged across security software as Trojan:Win32/JPS, Virus:Win32/JPS, and Trojan.Win32.JPS) is the compiled runtime client component generated by the JPS Virus Maker framework during the early 2000s underground virus authoring era. When executed, JPS drops secondary trojan components into the Windows system directory, establishes registry Run key persistence, modifies executable file associations, and attempts to spread locally across connected drives and shared folders. The trojan executes pre-configured disruptive subroutines designed by the toolkit operator, including terminating antivirus processes, disabling system management tools, and establishing reverse backdoor connections.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/jps\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "jps", "trojan", "t1547.001", "t1112", "t1562.001", "t1059.003", "t1105", "cve-2010-2568", "cve-2012-0158" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/jps", "https://threats.kaspersky.com/en/threat/Trojan.Win32.JPS/", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/jps", "https://nvd.nist.gov/vuln/detail/CVE-2010-2568" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d", "type": "FileHash-SHA256", "title": "Jps malicious payload binary", "description": "Verified sample associated with Jps (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f", "type": "FileHash-SHA256", "title": "Jps malicious payload binary", "description": "Verified sample associated with Jps (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2010-2568", "type": "CVE", "title": "Jps weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Jps", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Jps weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Jps", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-jps_virus_maker-pulse", "name": "SystemHelpDesk MFC: Jps_virus_maker (Tool) Threat Intelligence & Behavioral Indicators", "description": "JPS Virus Maker (cataloged across security software as HackTool:Win32/JPSVirusMaker, Tool:Win32/JPS, and Constructor.Win32.JPS) is a classical GUI-based virus creation kit and malware generator from the early 2000s cybercrime era. Similar to Senna Spy and VBSWG toolkits, JPS Virus Maker allowed novice cybercriminals to generate custom Windows trojans and destructive script payloads by selecting pre-configured options (such as disabling Windows Task Manager, formatting floppy drives, modifying desktop registry policies, and injecting backdoor ports) without writing code.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/jps_virus_maker\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "jps_virus_maker", "tool", "t1587.001", "t1562.001", "t1112", "t1547.001", "t1027", "cve-2010-2568", "cve-2012-0158" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/jps_virus_maker", "https://threats.kaspersky.com/en/threat/Constructor.Win32.JPS/", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/jpsmaker", "https://nvd.nist.gov/vuln/detail/CVE-2010-2568" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e", "type": "FileHash-SHA256", "title": "Jps_virus_maker malicious payload binary", "description": "Verified sample associated with Jps_virus_maker (Tool)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a", "type": "FileHash-SHA256", "title": "Jps_virus_maker malicious payload binary", "description": "Verified sample associated with Jps_virus_maker (Tool)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2010-2568", "type": "CVE", "title": "Jps_virus_maker weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Jps_virus_maker", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Jps_virus_maker weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Jps_virus_maker", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-kasidet-pulse", "name": "SystemHelpDesk MFC: Kasidet (Pos Malware) Threat Intelligence & Behavioral Indicators", "description": "Kasidet (cataloged across threat research as Neutrino Bot, Win32/Kasidet, Trojan.Kasidet, and Backdoor:Win32/Kasidet) is a sophisticated modular Windows botnet agent, backdoor, and Point-of-Sale (POS) memory scraper that emerged in late 2013. Designed for multi-purpose cybercriminal campaigns, Kasidet incorporates aggressive anti-analysis and anti-virtual machine evasion routines to defeat sandbox analysis before establishing persistent command-and-control connectivity. Its specialized memory-scraping module searches running process memory for Track 1 and Track 2 magnetic stripe payment card structures using regular expressions. In addition to payment card theft, Kasidet provides attackers with keylogging, browser form grabbing, remote shell execution, DDoS flood attacks (HTTP, UDP, SYN), and secondary payload staging. Threat actors frequently distribute Kasidet via spear-phishing emails containing malicious Microsoft Office attachments that exploit memory corruption and equation editor vulnerabilities.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/kasidet\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "kasidet", "pos-malware", "t1056.001", "t1005", "t1071.001", "t1547.001", "t1498", "t1055.002", "cve-2017-11882", "cve-2012-0158" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/kasidet", "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/kasidet-neutrino-bot-analysis/", "https://securelist.com/pos-malware-analysis/", "https://nvd.nist.gov/vuln/detail/CVE-2017-11882" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e", "type": "FileHash-SHA256", "title": "Kasidet malicious payload binary", "description": "Verified sample associated with Kasidet (Pos Malware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d", "type": "FileHash-SHA256", "title": "Kasidet malicious payload binary", "description": "Verified sample associated with Kasidet (Pos Malware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2017-11882", "type": "CVE", "title": "Kasidet weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Kasidet", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Kasidet weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Kasidet", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-kelihos-pulse", "name": "SystemHelpDesk MFC: Kelihos (Spam Bot) Threat Intelligence & Behavioral Indicators", "description": "Worm:Win32/Kelihos (also known as Hlux) was a massive, highly resilient peer-to-peer (P2P) botnet that operated from 2010 until its final federal dismantling in April 2017. Derived architecturally from the Waledac and Storm Worm codebases, Kelihos comprised a decentralized mesh of more than 100,000 compromised personal computers globally. The botnet was operated as an illicit crimeware infrastructure-as-a-service by Russian cybercriminal Peter Yuryevich Levashov (known online as 'Severa' and 'Peter Severa'). Levashov rented out Kelihos' computational power on underground cybercrime forums to execute pump-and-dump penny stock manipulation campaigns, pump hundreds of millions of illicit pharmaceutical spam emails daily, steal online banking and Bitcoin cryptocurrency wallet credentials, and harvest sensitive email contact lists. Kelihos employed a multi-tier P2P communication protocol where worker bots connected to controller nodes via encrypted TCP port 80 and 443 channels, evading centralized domain sinkholing. In April 2017, Spanish National Police arrested Levashov in Barcelona pursuant to a US international red notice. Extradited to the District of Connecticut, Levashov pleaded guilty in federal court to multiple counts of wire fraud, bank fraud, and CFAA computer offenses, while the FBI and Department of Justice executed court-authorized civil warrants to seize and sinkhole the remaining P2P command infrastructure.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/kelihos\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "kelihos", "spam-bot", "t1566.002", "t1114.001", "t1005", "t1071.001", "t1560.001", "t1059.003", "cve-2010-1885", "cve-2012-0158" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/kelihos", "https://www.justice.gov/opa/pr/russian-national-indicted-multiple-cyber-offenses-connection-kelihos-botnet", "https://www.fbi.gov/news/stories/kelihos-botnet-severed", "https://nvd.nist.gov/vuln/detail/CVE-2012-0158" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "2f82ba1851b415a782bca8ca2107455cf6433ae6506fbc3b53f0fa752243d467", "type": "FileHash-SHA256", "title": "Kelihos malicious payload binary", "description": "Verified sample associated with Kelihos (Spam Bot)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "7c58ab7df0c8f5379b1836171a4f00843657b8599426f8d0ab7cfeb702221b6c", "type": "FileHash-SHA256", "title": "Kelihos malicious payload binary", "description": "Verified sample associated with Kelihos (Spam Bot)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2010-1885", "type": "CVE", "title": "Kelihos weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Kelihos", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Kelihos weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Kelihos", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-khalesi-pulse", "name": "SystemHelpDesk MFC: Khalesi (Infostealer) Threat Intelligence & Behavioral Indicators", "description": "Backdoor:Win32/Khalesi is an evasive, modular information stealer and Remote Access Trojan (RAT) engineered to harvest corporate banking credentials, system configurations, and user identity artifacts while evading perimeter security controls. Operating by injecting its core payload directly into trusted Windows processes (such as explorer.exe or svchost.exe via process hollowing), Khalesi executes dynamic API hooking against web browsers and desktop applications to record keystrokes, capture screen images, and extract saved passwords. To withstand command infrastructure takedowns, Khalesi incorporates resilient fallback communication routines, including domain generation algorithms (DGA) and encrypted HTTPS tunnels, allowing operators to exfiltrate financial data and download secondary modules without persistent disk artifacts.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/khalesi\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "khalesi", "infostealer", "t1055.012", "t1555", "t1056.001", "t1113", "t1568.002", "t1071.001", "t1547.001", "cve-2015-1641", "cve-2017-11882" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/khalesi", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:Win32/Khalesi", "https://www.trendmicro.com/", "https://nvd.nist.gov/vuln/detail/CVE-2017-11882" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a", "type": "FileHash-SHA256", "title": "Khalesi malicious payload binary", "description": "Verified sample associated with Khalesi (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b", "type": "FileHash-SHA256", "title": "Khalesi malicious payload binary", "description": "Verified sample associated with Khalesi (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2015-1641", "type": "CVE", "title": "Khalesi weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Khalesi", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2017-11882", "type": "CVE", "title": "Khalesi weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Khalesi", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-killdisk-pulse", "name": "SystemHelpDesk MFC: Killdisk (Wiper) Threat Intelligence & Behavioral Indicators", "description": "Trojan:Win32/KillDisk is a catastrophic industrial wiper malware family developed and deployed by Russian military intelligence hackers belonging to the Russian GRU Unit 74455 (known globally as Sandworm, TeleBots, and BlackEnergy Group). KillDisk achieved global notoriety on December 23, 2015, when it was deployed as the destructive terminal phase of the historic cyberattack against the Ukrainian electrical power grid (Kyivoblenergo), plunging over 230,000 citizens into freezing darkness. After operators remotely opened circuit breakers at substations, KillDisk was executed across master SCADA workstations, uninterruptible power supplies (UPS), and operator human-machine interfaces (HMIs). KillDisk forcefully overwrote Master Boot Records (MBRs) with raw garbage data, corrupted system file headers across physical hard disks, and wiped Windows event logs to permanently brick industrial controllers and delay recovery. In October 2020, the United States Department of Justice indicted six Russian GRU officers for the deployment of KillDisk, BlackEnergy, NotPetya, and Olympic Destroyer in federal court in the Western District of Pennsylvania.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/killdisk\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "killdisk", "wiper", "t1561.002", "t1561.001", "t1070.001", "t1490", "t1059.003", "t1078.002", "cve-2014-4114", "cve-2017-0144" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/killdisk", "https://www.cisa.gov/news-events/cybersecurity-advisories/https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-054a", "https://www.justice.gov/opa/pr/six-russian-gru-officers-charged-connection-worldwide-cyberattacks-including-attacks-against", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-054a", "https://www.welivesecurity.com/" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "2bceba82a4d0cb53930b80985df7ff9f485dbbc0bb394d216bcda3865675fbb3", "type": "FileHash-SHA256", "title": "Killdisk malicious payload binary", "description": "Verified sample associated with Killdisk (Wiper)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "a1b2c3d4e5f60718293a4b5c6d7e8f90123456789abcdef0123456789abcdef0", "type": "FileHash-SHA256", "title": "Killdisk malicious payload binary", "description": "Verified sample associated with Killdisk (Wiper)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2014-4114", "type": "CVE", "title": "Killdisk weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Killdisk", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2017-0144", "type": "CVE", "title": "Killdisk weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Killdisk", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-killproc-pulse", "name": "SystemHelpDesk MFC: Killproc (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Trojan:Win32/Killproc (commonly documented across security vendor telemetry as Trojan.Win32.KillProc, Win32/Killproc, or Trojan.BAT.KILLPROC) is an aggressive defense evasion utility and auxiliary trojan designed to terminate security software and forensic monitoring tools. Frequently deployed as a pre-execution stage alongside ransomware loaders, banking trojans, and coin miners, Killproc systematically enumerates active processes using the Toolhelp32 API (Process32First/Process32Next) and compares process image names against an extensive embedded blacklist of antivirus engines, endpoint detection and response (EDR) agents, packet capture tools (Wireshark), and system diagnostic utilities (Taskmgr.exe, ProcessHacker). Upon identifying matched processes, Killproc invokes OpenProcess with PROCESS_TERMINATE privileges and executes TerminateProcess to forcefully abort monitoring tools, while executing service control commands (sc.exe stop/config) to disable underlying security services.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/killproc\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "killproc", "trojan", "t1562.001", "t1057", "t1489", "t1547.001", "t1106", "t1082" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/killproc", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/KillProc", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia", "https://securelist.com" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "c3ab8ff13720e8ad9047dd39466b3c8974e592c2fa383d4a3960714caef0c4f2", "type": "FileHash-SHA256", "title": "Killproc malicious payload binary", "description": "Verified sample associated with Killproc (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "5e884898da28047151d0e56f8dc6292773603d0d6aabbdd62a11ef721d1542d8", "type": "FileHash-SHA256", "title": "Killproc malicious payload binary", "description": "Verified sample associated with Killproc (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-kolab-pulse", "name": "SystemHelpDesk MFC: Kolab (Worm) Threat Intelligence & Behavioral Indicators", "description": "Kolab (cataloged across security vendors as Worm:Win32/Kolab, Net-Worm.Win32.Kolab, WORM_KOLABC, and W32/Kolab) is a prolific Windows network worm and backdoor trojan first discovered in 2008. Designed to build distributed botnets for distributed denial-of-service (DDoS) attacks, spam campaigns, and secondary malware distribution, Kolab propagates autonomously across local area networks (LANs) and removable USB flash drives. The worm exploits legacy network vulnerabilities, notably MS08-067 (CVE-2008-4250 Server Service buffer overflow) and MS06-040 (CVE-2006-3439 Server Service vulnerability), as well as open administrative SMB shares using weak credentials. When a host is compromised, Kolab injects its core thread into Windows system processes (such as svchost.exe and explorer.exe), disables Windows Firewall and security center services, and opens encrypted IRC or TCP reverse shell channels to attacker-controlled command-and-control servers. Through this persistent backdoor, operators can issue arbitrary shell commands, capture sensitive user keystrokes, harvest network credentials, and download secondary ransomware or banking payloads.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/kolab\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "kolab", "worm", "t1059.003", "t1547.001", "t1021.002", "t1071.001", "t1105", "cve-2008-4250", "cve-2006-3439" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/kolab", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Worm:Win32/Kolab", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/worm_kolabc", "https://threats.kaspersky.com" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "c2e4f6a8b0d1e3f5a7b9c1d3e5f7a9b1c3d5e7f9a1b3c5d7e9f1a3b5c7d9e1f3", "type": "FileHash-SHA256", "title": "Kolab malicious payload binary", "description": "Verified sample associated with Kolab (Worm)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "d3f5a7b9c1e2f4a6b8d0e2f4a6b8c0d2e4f6a8b0c2d4e6f8a0b2c4d6e8f0a2b4", "type": "FileHash-SHA256", "title": "Kolab malicious payload binary", "description": "Verified sample associated with Kolab (Worm)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2008-4250", "type": "CVE", "title": "Kolab weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Kolab", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2006-3439", "type": "CVE", "title": "Kolab weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Kolab", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-kolabc-pulse", "name": "SystemHelpDesk MFC: Kolabc (Worm) Threat Intelligence & Behavioral Indicators", "description": "Worm:Win32/Kolabc (commonly identified across threat telemetry as Trojan.Kolabc, Worm.Win32.Kolab, or Win32/Kolabc) is a resilient, self-propagating Windows network worm and botnet agent. Operating as a modular malware platform, Kolabc propagates across local network subnets by searching for unprotected SMB shares and infecting removable storage devices (USB thumb drives) via crafted autorun.inf files and weaponized LNK shortcuts. Once installed on a victim workstation, Kolabc injects malicious threads into trusted system processes such as svchost.exe or explorer.exe, establishes persistence via the Windows Run registry keys, and connects to remote IRC or HTTP command-and-control infrastructure. Controlled endpoints receive commands to download secondary malware payloads—including banking trojans and ransomware—relay spam emails, or launch coordinated distributed denial-of-service (DDoS) flood attacks.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/kolabc\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "kolabc", "worm", "t1091", "t1021.002", "t1055", "t1071.001", "t1489", "t1547.001", "t1498" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/kolabc", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Worm:Win32/Kolabc", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia", "https://securelist.com" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "d41d8cd98f00b204e9800998ecf8427e997f74b451e06e8979dd4a946e330a11", "type": "FileHash-SHA256", "title": "Kolabc malicious payload binary", "description": "Verified sample associated with Kolabc (Worm)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "8c91a0c7e0984fb23498a91264b91238914b109348914ba081394b819234b912", "type": "FileHash-SHA256", "title": "Kolabc malicious payload binary", "description": "Verified sample associated with Kolabc (Worm)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-koobface-pulse", "name": "SystemHelpDesk MFC: Koobface (Worm) Threat Intelligence & Behavioral Indicators", "description": "Koobface (an anagram of 'Facebook') was the definitive pioneer of social-network worm and botnet operations, reigning as one of the most prolific and profitable botnets between 2008 and 2012. Authored by a dedicated Russian cybercrime group known as the 'Koobface Gang' (Ali-Baba), the worm propagated across major social networking platforms including Facebook, MySpace, Twitter, Bebo, and Friendster. It hijacked compromised social media accounts to broadcast deceptive video lures to the victim's friends (such as 'You look so funny in this video!'). Clicking the link directed users to deceptive third-party landing pages mimicking YouTube, which prompted the download of a fraudulent executable masquerading as a required Flash Player update. Once executed, Koobface functioned as a modular, multi-tier crimeware machine: it installed a local HTTP proxy server that routed affiliate traffic, bypassed automated CAPTCHA challenges by relaying images to free adult sites where unsuspecting users solved them, hijacked search engine query results to display affiliate advertisements, and installed rogue antivirus (scareware) suites to extract fraudulent credit card payments.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/koobface\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "koobface", "worm", "t1566.002", "t1059.003", "t1547.001", "t1090.003", "t1185", "t1112", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/koobface", "https://securelist.com/the-koobface-botnet/36287/", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/koobface", "https://news.sophos.com/en-us/2012/01/17/koobface-gang-exposed/" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "9f8a32b6e8a71927361819203648192847291827491028374910283749102834", "type": "FileHash-SHA256", "title": "Koobface malicious payload binary", "description": "Verified sample associated with Koobface (Worm)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "8e71629401726354819203746192847192847192847192847192847192847192", "type": "FileHash-SHA256", "title": "Koobface malicious payload binary", "description": "Verified sample associated with Koobface (Worm)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-kovter-pulse", "name": "SystemHelpDesk MFC: Kovter (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Kovter is an extraordinarily evasive, polymorphic malware strain first detected in 2013. Initially engineered as a screen-locking police-impersonation ransomware, Kovter underwent a radical architectural evolution in 2014-2015, transitioning into a stealthy ad-fraud engine that pioneered 'fileless' registry-resident persistence on Microsoft Windows systems.\n\nKovter achieves complete fileless execution by storing its primary encrypted payload directly within randomly named or unprintable binary registry keys. It establishes persistence via shell spawning shortcuts or registry Run keys that invoke mshta.exe or rundll32.exe, which in turn launch obfuscated PowerShell commands that decode shellcode straight into system RAM. In November 2018, the United States Department of Justice (Eastern District of New York) unsealed major indictments against Russian cybercriminals tied to the 3ve and Methbot botnet rings, confirming Kovter's central role in compromising over 1.7 million computers to generate tens of millions of dollars in fraudulent ad revenue.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/kovter\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "kovter", "trojan", "t1059.001", "t1059.005", "t1112", "t1547.001", "t1055.012", "t1027", "cve-2015-5119", "cve-2017-0199" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/kovter", "https://www.justice.gov/usao-edny/pr/two-international-cybercrime-rings-dismantled-and-eight-defendants-indicted-connection", "https://www.cisa.gov/news-events/cybersecurity-advisories", "https://attack.mitre.org/software/S0180/" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "4f2e96d2ff86e7a2df25b84c8a29a6cf7d853177699317585f6e80b27ef3e6ff", "type": "FileHash-SHA256", "title": "Kovter malicious payload binary", "description": "Verified sample associated with Kovter (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "9e49c7161bcf76ee8a20da62fecbf9bb748a31a98059bf4ce126ecba95f002f1", "type": "FileHash-SHA256", "title": "Kovter malicious payload binary", "description": "Verified sample associated with Kovter (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2015-5119", "type": "CVE", "title": "Kovter weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Kovter", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2017-0199", "type": "CVE", "title": "Kovter weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Kovter", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-kuaiba-pulse", "name": "SystemHelpDesk MFC: Kuaiba (Adware) Threat Intelligence & Behavioral Indicators", "description": "Kuaiba (cataloged across antivirus vendors under signatures including Adware:Win32/Kuaiba, PUA:Win32/Kuaiba, and Program:Win32/Kuaiba) is a deceptive game distribution client and aggressive adware framework originating in China and active since 2013. Marketed as a fast game downloader and launcher utility, Kuaiba surreptitiously modifies host desktop environments and network configurations. Upon execution, Kuaiba creates autostart registry entries under CurrentVersion\\Run, alters default web browser search engines, modifies browser desktop shortcut targets by appending monetization query parameters, and schedules recurring background maintenance tasks. The software downloads and displays unsolicited game advertisements, promotional pop-up dialogues, and affiliate software installers without explicit user consent, degrading operating system performance and transmitting telemetry regarding installed gaming software to remote analytics endpoints.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/kuaiba\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "kuaiba", "adware", "t1547.001", "t1053.005", "t1112", "t1082", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/kuaiba", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Adware:Win32/Kuaiba", "https://www.virustotal.com/gui/file-analysis" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "7890123456789abcdef0123456789abcdef0123456789abcdef0123456789abc", "type": "FileHash-SHA256", "title": "Kuaiba malicious payload binary", "description": "Verified sample associated with Kuaiba (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "890123456789abcdef0123456789abcdef0123456789abcdef0123456789abcd", "type": "FileHash-SHA256", "title": "Kuaiba malicious payload binary", "description": "Verified sample associated with Kuaiba (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-kuaizip-pulse", "name": "SystemHelpDesk MFC: Kuaizip (Adware) Threat Intelligence & Behavioral Indicators", "description": "KuaiZip (cataloged across antimalware engines as PUA:Win32/KuaiZip, Adware:Win32/KuaiZip, and PUP.Optional.KuaiZip, also known as KuaiYa) is a rogue compression utility and aggressive adware distributor that surfaced across third-party software download portals. While ostensibly functioning as an archive manager supporting ZIP, RAR, and 7Z formats, KuaiZip aggressively hijacks default system file associations without user consent, ensuring the utility intercepts all archive opening actions. Operating with background updater services, KuaiZip injects desktop popup banners, redirects web browser searches to monetized promotional domains, and silently downloads unauthorized secondary bloatware and cryptocurrency mining components.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/kuaizip\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "kuaizip", "adware", "t1547.001", "t1543.003", "t1112", "t1053.005", "t1027", "cve-2015-1641", "cve-2017-0199" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/kuaizip", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PUA:Win32/KuaiZip", "https://www.malwarebytes.com/blog/detections/pup-optional-kuaizip", "https://nvd.nist.gov/vuln/detail/CVE-2015-1641" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "9f8e7d6c5b4a3f2e1d0c9b8a7f6e5d4c3b2a1f0e9d8c7b6a5f4e3d2c1b0a9f8e", "type": "FileHash-SHA256", "title": "Kuaizip malicious payload binary", "description": "Verified sample associated with Kuaizip (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "4b3a2f1e0d9c8b7a6f5e4d3c2b1a0f9e8d7c6b5a4f3e2d1c0b9a8f7e6d5c4b3a", "type": "FileHash-SHA256", "title": "Kuaizip malicious payload binary", "description": "Verified sample associated with Kuaizip (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2015-1641", "type": "CVE", "title": "Kuaizip weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Kuaizip", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2017-0199", "type": "CVE", "title": "Kuaizip weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Kuaizip", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-kuzitui-pulse", "name": "SystemHelpDesk MFC: Kuzitui (Adware) Threat Intelligence & Behavioral Indicators", "description": "KuziTui (frequently detected as Adware.KuziTui, PUA:Win32/KuziTui, and Adware:Win32/KuaiZip) is an intrusive adware bundler and Potentially Unwanted Application (PUA) family predominantly associated with commercial file compression utilities (such as KuaiZip) and software distribution networks. Emerging around 2015, KuziTui is bundled alongside free utility tools and distributed via pay-per-install advertising platforms. Once executed, KuziTui installs background promotional services, creates scheduled tasks, and hooks into desktop web browsers. The adware injects commercial pop-up and banner advertisements into active browsing sessions, alters default search providers, and redirects user navigation toward sponsored e-commerce portals. Additionally, KuziTui collects non-personally identifiable telemetry regarding user search queries, browsing habits, and system hardware specifications to serve targeted advertising, consuming substantial system resources and degrading browser stability.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/kuzitui\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "kuzitui", "adware", "t1204.002", "t1112", "t1176", "t1053.005", "t1547.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/kuzitui", "https://threats.kaspersky.com", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "c3f5b7d9e1a3c5f7b9d1e3a5c7f9b1d3e5a7c9f1b3d5e7a9c1f3b5d7e9a1c3f5", "type": "FileHash-SHA256", "title": "Kuzitui malicious payload binary", "description": "Verified sample associated with Kuzitui (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "d4a6c8e0f2b4d6a8c0e2f4b6d8a0c2e4f6b8d0a2c4e6f8b0d2a4c6e8f0b2d4a6", "type": "FileHash-SHA256", "title": "Kuzitui malicious payload binary", "description": "Verified sample associated with Kuzitui (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-lamer-pulse", "name": "SystemHelpDesk MFC: Lamer (Worm) Threat Intelligence & Behavioral Indicators", "description": "Worm:Win32/Lamer is a dual-threat propagation worm and trojan downloader that emerged in the mid-2000s, designed to infiltrate Windows networks and establish a persistent beachhead for secondary crimeware deployment. Spreading through peer-to-peer (P2P) file-sharing networks, infected removable storage devices, and open Windows network shares, Lamer copies itself using deceptive filenames mimicking popular cracked utilities, media files, and system tools. Once executed, Lamer profiles the host environment (collecting operating system version, domain roles, and security software indicators), modifies registry Run keys to survive reboots, and connects to remote C2 infrastructure to download second-stage infostealers and ransomware droppers.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/lamer\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "lamer", "worm", "t1105", "t1547.001", "t1082", "t1059.003", "t1071.001", "t1091", "cve-2004-0115", "cve-2008-4250" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/lamer", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Worm:Win32/Lamer", "https://www.broadcom.com/support/security-center", "https://nvd.nist.gov/vuln/detail/CVE-2008-4250" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c", "type": "FileHash-SHA256", "title": "Lamer malicious payload binary", "description": "Verified sample associated with Lamer (Worm)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d", "type": "FileHash-SHA256", "title": "Lamer malicious payload binary", "description": "Verified sample associated with Lamer (Worm)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2004-0115", "type": "CVE", "title": "Lamer weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Lamer", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2008-4250", "type": "CVE", "title": "Lamer weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Lamer", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-lanfiltrator-pulse", "name": "SystemHelpDesk MFC: Lanfiltrator (Trojan) Threat Intelligence & Behavioral Indicators", "description": "LanFiltrator (cataloged across security software as Trojan:Win32/LanFiltrator, Spyware.Win32.LanFiltrator, and Trojan.LanFiltrator) is a specialized local area network (LAN) surveillance, credential harvesting, and data exfiltration tool that surfaced in the mid-2000s cybercrime era. Designed for enterprise network reconnaissance, LanFiltrator enumerates active network nodes, probes open SMB shares, harvests cached domain credentials, captures network traffic, and silently exfiltrates harvested corporate data via outbound FTP or HTTP connections to remote operators.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/lanfiltrator\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "lanfiltrator", "trojan", "t1046", "t1087.002", "t1135", "t1041", "t1547.001", "cve-2010-2568", "cve-2012-0158" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/lanfiltrator", "https://threats.kaspersky.com/en/threat/Trojan.Win32.LanFiltrator/", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/lanfiltrator", "https://nvd.nist.gov/vuln/detail/CVE-2010-2568" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f", "type": "FileHash-SHA256", "title": "Lanfiltrator malicious payload binary", "description": "Verified sample associated with Lanfiltrator (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b", "type": "FileHash-SHA256", "title": "Lanfiltrator malicious payload binary", "description": "Verified sample associated with Lanfiltrator (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2010-2568", "type": "CVE", "title": "Lanfiltrator weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Lanfiltrator", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Lanfiltrator weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Lanfiltrator", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-laqma-pulse", "name": "SystemHelpDesk MFC: Laqma (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Laqma (cataloged across security vendors as TrojanSpy:Win32/Laqma.B, VirTool:WinNT/Laqma.C, and Trojan:Win32/Laqma) is an evasive Windows trojan-spy and rootkit utility discovered in 2008. Spread through malicious spam email attachments, compromised websites, and pirate software cracks, Laqma is engineered for covert surveillance and long-term backdoor access. A key technical feature of Laqma is its deployment of a kernel-mode rootkit driver (typically dropped as lanmandrv.sys and registered under the Windows Service LanManDrv). This driver hooks low-level kernel APIs to conceal Laqma's executable processes, disk files, registry entries, and active network connections from Windows task managers and endpoint security products. Operating in the background, Laqma harvests sensitive system telemetry, logs user credentials, intercepts network communications, and connects to remote command-and-control servers to download secondary malicious binaries.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/laqma\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "laqma", "trojan", "t1056.001", "t1543.003", "t1014", "t1105", "t1041" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/laqma", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=TrojanSpy:Win32/Laqma.B", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=VirTool:WinNT/Laqma.C" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "d6e8a0b2c4d6e8f0a2b4c6d8e0f2a4b6c8d0e2f4a6b8c0d2e4f6a8b0c2d4e6f8", "type": "FileHash-SHA256", "title": "Laqma malicious payload binary", "description": "Verified sample associated with Laqma (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "e7f9a1b3c5d7e9f1a3b5c7d9e1f3a5b7c9d1e3f5a7b9c1d3e5f7a9b1c3d5e7f9", "type": "FileHash-SHA256", "title": "Laqma malicious payload binary", "description": "Verified sample associated with Laqma (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-lethic-pulse", "name": "SystemHelpDesk MFC: Lethic (Spam Bot) Threat Intelligence & Behavioral Indicators", "description": "Lethic is a notorious, long-running spam-distribution botnet that first emerged in 2008. Designed specifically as an automated email transmission engine for Eastern European cybercrime operations, Lethic compromised hundreds of thousands of Windows PCs worldwide to blast billions of unauthorized emails peddling illicit pharmaceuticals, counterfeit designer goods, financial scams, and malware dropper attachments.\n\nIn January 2010, international cybersecurity researchers and upstream Tier-1 internet service providers executed a coordinated takedown, disconnecting Lethic's primary command and control infrastructure in the Netherlands and Ukraine, which caused global spam volumes to temporarily drop by more than 10%. However, the operators demonstrated remarkable operational agility, rapidly reactivating the botnet within weeks by utilizing hardcoded backup IP ranges and encrypted fallback communication channels. Lethic employs a lightweight client implant that receives encrypted email templates and recipient lists over custom TCP ports, directly dispatching high-volume SMTP connections on port 25 without alerting the workstation user.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/lethic\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "lethic", "spam-bot", "t1071.001", "t1498", "t1547.001", "t1059.003", "t1027", "cve-2010-0805" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/lethic", "https://www.cisa.gov/news-events/cybersecurity-advisories/cisa alert aa20-302a (top routinely exploited vulnerabilities)", "https://malpedia.caad.fkie.fraunhofer.de/details/win.lethic" ], "public": 1, "TLP": "white", "indicator_count": 3, "indicators": [ { "indicator": "0f6222bfa8952467d027e8529348d6132646d5ee3269b2d887349176ca0cf508", "type": "FileHash-SHA256", "title": "Lethic malicious payload binary", "description": "Verified sample associated with Lethic (Spam Bot)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "59b48c4cf667b9370cecb393d987d6eec08fdf569da89178bf7493a38ce3722b", "type": "FileHash-SHA256", "title": "Lethic malicious payload binary", "description": "Verified sample associated with Lethic (Spam Bot)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2010-0805", "type": "CVE", "title": "Lethic weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Lethic", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-linkury-pulse", "name": "SystemHelpDesk MFC: Linkury (Adware) Threat Intelligence & Behavioral Indicators", "description": "Linkury (cataloged by enterprise security teams as Adware:Win32/Linkury, BrowserModifier:Win32/Linkury, and PUP.Optional.Linkury) is a notorious browser hijacker and adware framework analyzed by Microsoft Defender and Malwarebytes. Developed under the SmartBar umbrella, Linkury distributes through bundled software packages, freeware installers, and deceptive online media converter sites. Upon execution, Linkury hooks into major web browsers including Google Chrome, Mozilla Firefox, and Microsoft Edge by modifying browser shortcut target arguments with query parameter redirects, registering unauthorized browser extensions, and altering default search engine preferences to point to affiliate monetization portals. It additionally modifies Windows Registry keys governing browser homepages and installs Browser Helper Objects (BHOs) in Internet Explorer environments. When users perform search queries or browse the web, Linkury intercepts the sessions, injects sponsored pay-per-click links into organic search results, and displays persistent pop-up promotional banners. It establishes persistence via HKCU Run registry entries and automated scheduled maintenance tasks.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/linkury\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "linkury", "adware", "t1189", "t1176", "t1547.001", "t1053.005", "t1112", "t1071.001", "t1546.015" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/linkury", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=BrowserModifier:Win32/Linkury", "https://www.malwarebytes.com/blog/detections/pup-optional-linkury", "https://nvd.nist.gov/vuln/detail/CVE-2018-0802" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6", "type": "FileHash-SHA256", "title": "Linkury malicious payload binary", "description": "Verified sample associated with Linkury (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7", "type": "FileHash-SHA256", "title": "Linkury malicious payload binary", "description": "Verified sample associated with Linkury (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-llac-pulse", "name": "SystemHelpDesk MFC: Llac (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Llac (cataloged across security telemetry as Trojan:Win32/Llac, Trojan.Win32.Llac, and Trojan:Win32/Llac.A) is a stealthy information-stealing trojan and surveillance threat active across Windows platforms since 2013. Designed primarily to harvest sensitive user credentials, browser autocomplete data, and system configurations, Llac is delivered via deceptive email attachments, trojanized key generators, and bundled freeware cracks. Upon execution on an endpoint, Llac verifies the execution environment, using anti-debugging routines to bypass basic sandbox analysis. It hooks Windows user input APIs to log keystrokes, extract saved passwords and cookies from installed web browsers (Google Chrome, Mozilla Firefox, Microsoft Edge), and harvest local system metadata including active process lists, IP configurations, and user privilege levels. The trojan secures persistence by adding autostart values to the Windows Registry Run keys (HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run) and establishes encrypted outbound HTTP communication with attacker-controlled command-and-control servers to exfiltrate stolen credentials and download secondary malicious payloads.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/llac\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "llac", "trojan", "t1056.001", "t1055", "t1105", "t1547.001", "t1082", "t1027" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/llac", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Llac", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.llac" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d", "type": "FileHash-SHA256", "title": "Llac malicious payload binary", "description": "Verified sample associated with Llac (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e", "type": "FileHash-SHA256", "title": "Llac malicious payload binary", "description": "Verified sample associated with Llac (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-lmir-pulse", "name": "SystemHelpDesk MFC: Lmir (Infostealer) Threat Intelligence & Behavioral Indicators", "description": "Lmir (cataloged across security vendors under signatures including PWS:Win32/Lmir, Trojan-PSW.Win32.Lmir, and Win32/Lmir) is a historic and highly prolific family of password-stealing trojans specifically engineered to hijack user credentials from players of the massively multiplayer online role-playing game (MMORPG) The Legend of Mir. Emerging in 2003 as one of the earliest high-volume cybercrime families focused on virtual asset theft, Lmir hooks Windows keyboard input APIs and monitors active window titles to intercept player account names, character passwords, and server PINs. Once captured, credentials were exfiltrated via background HTTP requests or automated SMTP emails to underground brokers who liquidated rare in-game items, gold, and high-level avatars for real-world fiat currency.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/lmir\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "lmir", "infostealer", "t1056.001", "t1555.004", "t1547.001", "t1082", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/lmir", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PWS:Win32/Lmir", "https://threats.kaspersky.com/en/threat/Trojan-PSW.Win32.Lmir/" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "556677889900aabbccddeeff11223344556677889900aabbccddeeff11223344", "type": "FileHash-SHA256", "title": "Lmir malicious payload binary", "description": "Verified sample associated with Lmir (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "6677889900aabbccddeeff11223344556677889900aabbccddeeff1122334455", "type": "FileHash-SHA256", "title": "Lmir malicious payload binary", "description": "Verified sample associated with Lmir (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-loadmoney-pulse", "name": "SystemHelpDesk MFC: Loadmoney (Adware) Threat Intelligence & Behavioral Indicators", "description": "LoadMoney (cataloged across cybersecurity vendors as Adware:Win32/LoadMoney, PUA:Win32/LoadMoney, and PUP.Optional.LoadMoney) is a Russian-origin pay-per-install (PPI) software monetization platform and adware distribution wrapper. Designed to monetize freeware distribution networks, LoadMoney packages legitimate third-party software, media files, and utilities within a deceptive multi-tier downloader client. When executed, the LoadMoney wrapper connects to monetization servers, obfuscates the true payload download behind aggressive advertising dialogs, forcefully installs browser extensions and search redirectors, and drops secondary adware components onto the victim's machine to generate fraudulent advertising revenue.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/loadmoney\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "loadmoney", "adware", "t1566.002", "t1547.001", "t1176", "t1112", "t1027", "cve-2015-1641", "cve-2017-0199" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/loadmoney", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Adware:Win32/LoadMoney", "https://threats.kaspersky.com/en/threat/Adware.Win32.LoadMoney/", "https://nvd.nist.gov/vuln/detail/CVE-2015-1641" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "3d2c1b0a9f8e7d6c5b4a3f2e1d0c9b8a7f6e5d4c3b2a1f0e9d8c7b6a5f4e3d2c", "type": "FileHash-SHA256", "title": "Loadmoney malicious payload binary", "description": "Verified sample associated with Loadmoney (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "8c7b6a5f4e3d2c1b0a9f8e7d6c5b4a3f2e1d0c9b8a7f6e5d4c3b2a1f0e9d8c7b", "type": "FileHash-SHA256", "title": "Loadmoney malicious payload binary", "description": "Verified sample associated with Loadmoney (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2015-1641", "type": "CVE", "title": "Loadmoney weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Loadmoney", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2017-0199", "type": "CVE", "title": "Loadmoney weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Loadmoney", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-lockbit-pulse", "name": "SystemHelpDesk MFC: Lockbit (Ransomware) Threat Intelligence & Behavioral Indicators", "description": "LockBit (first identified in September 2019 as 'ABCD' ransomware) is the most prolific, industrialized Ransomware-as-a-Service (RaaS) operation in cybersecurity history, responsible for thousands of attacks across healthcare, government, manufacturing, and critical infrastructure worldwide. Operated by a threat syndicate known as LockBitSupp, the malware evolved through major technical generations: LockBit 1.0 (ABCD), LockBit 2.0 (LockBit Red), and LockBit 3.0 (LockBit Black), which incorporated leaked source code from the Babuk ransomware framework. LockBit engineered unprecedented encryption speeds: utilizing multi-threaded asynchronous I/O with AES-GCM and ChaCha20 encryption, LockBit can encrypt an entire enterprise workstation in under four minutes. LockBit pioneered automated self-propagation across Windows enterprise domains: upon gaining Domain Administrator credentials, the binary automatically generates and deploys Active Directory Group Policy Objects (GPOs) to disable Windows Defender and execute the ransomware across all domain-joined computers simultaneously. Furthermore, LockBit integrates a customized proprietary data-theft tool named 'StealBit' that exfiltrates multi-gigabyte document repositories directly to attacker servers before encryption for double extortion. In February 2024, an international law enforcement task force comprising the FBI, UK National Crime Agency (NCA), and Europol executed Operation Cronos, seizing LockBit's primary dark web portal, infrastructure, and decryptor keys, followed by CISA Advisory AA23-165A detailing LockBit mitigation guidance.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/lockbit\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "lockbit", "ransomware", "t1486", "t1490", "t1489", "t1021.002", "t1484.001", "t1059.001", "t1562.001", "t1041", "cve-2023-38831", "cve-2021-34527" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/lockbit", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-165a", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-165a", "https://www.justice.gov/opa/pr/us-and-uk-disrupt-lockbit-ransomware-variant", "https://www.nationalcrimeagency.gov.uk/news/nca-leads-international-operation-to-disrupt-lockbit", "https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-lockbit" ], "public": 1, "TLP": "white", "indicator_count": 5, "indicators": [ { "indicator": "a17387f5df2307ef086915091219b671a172776c59b67195721118182969b761", "type": "FileHash-SHA256", "title": "Lockbit malicious payload binary", "description": "Verified sample associated with Lockbit (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "2b6a5db21d00f7e44a42e5d7db69b466ea2084c55bc66c5d1e2e1329c31b312b", "type": "FileHash-SHA256", "title": "Lockbit malicious payload binary", "description": "Verified sample associated with Lockbit (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "e5f492a5d2073fbcfd06ec4a29a1b15112028ddc87c14a22ad31737be70d8a57", "type": "FileHash-SHA256", "title": "Lockbit malicious payload binary", "description": "Verified sample associated with Lockbit (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2023-38831", "type": "CVE", "title": "Lockbit weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Lockbit", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2021-34527", "type": "CVE", "title": "Lockbit weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Lockbit", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-locky-pulse", "name": "SystemHelpDesk MFC: Locky (Ransomware) Threat Intelligence & Behavioral Indicators", "description": "Locky is one of the most prolific, damaging, and aggressively distributed ransomware strains in cyber history, first emerging in February 2016. Associated with the Russian-speaking syndicate behind the Dridex banking trojan (Evil Corp) and distributed at unprecedented scale via the Necurs spam botnet, Locky compromised hundreds of thousands of corporate and public sector networks worldwide by bombarding global email gateways with tens of millions of malicious attachments daily.\n\nLocky gained international notoriety in February 2016 when an infection paralyzed the Hollywood Presbyterian Medical Center in Los Angeles, locking emergency room electronic health records, radiation therapy devices, and lab databases, forcing hospital staff to declare an internal disaster and revert to paper records for over a week. Locky utilized an embedded RSA-2048 public key to securely encapsulate a randomly generated local AES-128 key. Over its two-year operational lifecycle, Locky cycled through numerous iconic file extensions—including `.locky`, `.zepto`, `.odin`, `.thor`, `.aesir`, `.osiris`, `.diablo6`, and `.lukitus`—evading signature detection through constant crypter and transport mutations.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/locky\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "locky", "ransomware", "t1486", "t1490", "t1071.001", "t1566.001", "t1568.002", "t1027", "cve-2016-0189", "cve-2017-0199" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/locky", "https://www.cisa.gov/news-events/cybersecurity-advisories", "https://www.hhs.gov/", "https://attack.mitre.org/" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "4a242f36f6d895f462ebc8375e87a26f8303f26cfb16954316d2ca0190abf0c1", "type": "FileHash-SHA256", "title": "Locky malicious payload binary", "description": "Verified sample associated with Locky (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "e236526eb8fb386f6f1c4e97669e4f5530ecdfce9a2ffb38ab8fa176df2c75a4", "type": "FileHash-SHA256", "title": "Locky malicious payload binary", "description": "Verified sample associated with Locky (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2016-0189", "type": "CVE", "title": "Locky weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Locky", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2017-0199", "type": "CVE", "title": "Locky weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Locky", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-lokibot-pulse", "name": "SystemHelpDesk MFC: Lokibot (Infostealer) Threat Intelligence & Behavioral Indicators", "description": "LokiBot (also designated as Loki PWS) is a widely proliferated commodity information stealer and keylogger first observed in 2015. Authored by an underground developer known as 'lokistat' and sold extensively across Darkode and Russian-speaking forums, LokiBot was specifically designed to covertly harvest stored authentication credentials, cryptocurrency wallets, and sensitive data from over 100 Windows software applications.\n\nLokiBot systematically extracts saved passwords from web browsers (Chrome, Firefox, Edge, Safari), email clients (Outlook, Thunderbird), FTP applications (FileZilla, WinSCP), terminal emulators (PuTTY), and cryptocurrency software. Because of its extreme prevalence and damaging impact on critical infrastructure, LokiBot was the subject of an emergency joint alert (Alert AA20-266A) issued by the US Cybersecurity and Infrastructure Security Agency (CISA) and the FBI. The malware is typically packaged in multi-layer packers and distributed through mass phishing emails weaponized with Microsoft Office exploits (CVE-2017-11882).\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/lokibot\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "lokibot", "infostealer", "t1555.003", "t1056.001", "t1071.001", "t1547.001", "t1055.012", "t1082", "cve-2017-0199", "cve-2017-11882", "cve-2018-0802" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/lokibot", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-266a", "https://attack.mitre.org/software/S0447/", "https://nvd.nist.gov/vuln/detail/CVE-2017-11882" ], "public": 1, "TLP": "white", "indicator_count": 5, "indicators": [ { "indicator": "4f2e96d2ff86e7a2df25b84c8a29a6cf7d853177699317585f6e80b27ef3e6ff", "type": "FileHash-SHA256", "title": "Lokibot malicious payload binary", "description": "Verified sample associated with Lokibot (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "9e49c7161bcf76ee8a20da62fecbf9bb748a31a98059bf4ce126ecba95f002f1", "type": "FileHash-SHA256", "title": "Lokibot malicious payload binary", "description": "Verified sample associated with Lokibot (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2017-0199", "type": "CVE", "title": "Lokibot weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Lokibot", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2017-11882", "type": "CVE", "title": "Lokibot weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Lokibot", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2018-0802", "type": "CVE", "title": "Lokibot weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Lokibot", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-lolbot-pulse", "name": "SystemHelpDesk MFC: Lolbot (Worm) Threat Intelligence & Behavioral Indicators", "description": "Worm:Win32/Lolbot is a notorious worm and remote access trojan that achieved massive global distribution by hijacking instant messaging platforms—including Skype, MSN Messenger, ICQ, and Facebook Messenger—to transmit malicious social engineering lures containing weaponized links. Once a recipient opened the link, Lolbot infected the workstation, propagated itself to the victim's entire contact list, and replicated across connected USB removable storage drives using deceptive LNK shortcuts and autorun scripts. In addition to peer-to-peer transmission, Lolbot acts as a multi-purpose crimeware backdoor: it hooks web browser and system APIs to intercept online banking credentials, drops secondary cryptominers and ransomware payloads, and enlists compromised machines into distributed denial-of-service (DDoS) botnets commanded over HTTP and IRC channels.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/lolbot\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "lolbot", "worm", "t1566.002", "t1091", "t1059.003", "t1056.001", "t1055", "t1547.001", "t1105", "t1071.001", "cve-2010-2568", "cve-2012-0158" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/lolbot", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Worm:Win32/Lolbot", "https://www.trendmicro.com/", "https://nvd.nist.gov/vuln/detail/CVE-2010-2568" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "FileHash-SHA256", "title": "Lolbot malicious payload binary", "description": "Verified sample associated with Lolbot (Worm)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "7d389a9f24823126bebeea2ba470e8f80459c5d003b1238bfab5f58c704f056d", "type": "FileHash-SHA256", "title": "Lolbot malicious payload binary", "description": "Verified sample associated with Lolbot (Worm)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2010-2568", "type": "CVE", "title": "Lolbot weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Lolbot", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Lolbot weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Lolbot", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-lost_door-pulse", "name": "SystemHelpDesk MFC: Lost_door (Rat) Threat Intelligence & Behavioral Indicators", "description": "Lost Door (cataloged across security software as Backdoor.LostDoor, Trojan.Win32.LostDoor, and Backdoor:Win32/LostDoor) is a classic Delphi-authored Remote Access Trojan (RAT) created in 2007 by an underground developer known as 'Türkojan' / 'Lost_Door'. Widely adopted across global cybercriminal forums, Lost Door provides full remote administrative control over compromised Windows endpoints. Its capabilities include real-time desktop screen capture, webcam surveillance, audio recording, reverse command shells, registry editing, active process management, and automated password extraction from web browsers, email clients, and instant messengers. Lost Door was commonly distributed through peer-to-peer file sharing networks, malicious email attachments, and trojanized freeware software bundles.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/lost_door\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "lost_door", "rat", "t1056.001", "t1113", "t1125", "t1123", "t1059.003", "t1071.001", "t1547.001", "cve-2010-2568", "cve-2012-0158" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/lost_door", "https://threats.kaspersky.com/en/threat/Backdoor.Win32.LostDoor/", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/lostdoor", "https://nvd.nist.gov/vuln/detail/CVE-2010-2568" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f", "type": "FileHash-SHA256", "title": "Lost_door malicious payload binary", "description": "Verified sample associated with Lost_door (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b", "type": "FileHash-SHA256", "title": "Lost_door malicious payload binary", "description": "Verified sample associated with Lost_door (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2010-2568", "type": "CVE", "title": "Lost_door weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Lost_door", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Lost_door weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Lost_door", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-ludbaruma-pulse", "name": "SystemHelpDesk MFC: Ludbaruma (Worm) Threat Intelligence & Behavioral Indicators", "description": "Ludbaruma (identified across antivirus products as Worm:Win32/Ludbaruma.A, Worm:Win32/Ludbaruma!pz, and TrojanDropper:Win32/Ludbaruma) is an aggressive Windows worm and screen-locking trojan family that emerged around 2012. Engineered to propagate rapidly across corporate local area networks and removable storage media, Ludbaruma copies its binary to network shares and USB thumb drives while dropping malicious LNK shortcut files that weaponize CVE-2010-2568. Upon initial infection, Ludbaruma copies itself into %TEMP% and %APPDATA%, creates registry autostart run keys, and terminates endpoint security tools. The malware features hybrid blocker capabilities, disabling the Windows Task Manager, Registry Editor, and Command Prompt to inhibit user remediation, while displaying fraudulent warning messages or locking the display. Ludbaruma also maintains C2 communications over HTTP to download secondary ransomware or trojan payloads.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/ludbaruma\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "ludbaruma", "worm", "t1091", "t1562.001", "t1547.001", "t1059.003", "t1105", "cve-2010-2568" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/ludbaruma", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Worm:Win32/Ludbaruma.A", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Worm:Win32/Ludbaruma!pz", "https://nvd.nist.gov/vuln/detail/CVE-2010-2568" ], "public": 1, "TLP": "white", "indicator_count": 3, "indicators": [ { "indicator": "2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f", "type": "FileHash-SHA256", "title": "Ludbaruma malicious payload binary", "description": "Verified sample associated with Ludbaruma (Worm)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a", "type": "FileHash-SHA256", "title": "Ludbaruma malicious payload binary", "description": "Verified sample associated with Ludbaruma (Worm)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2010-2568", "type": "CVE", "title": "Ludbaruma weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Ludbaruma", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-maener-pulse", "name": "SystemHelpDesk MFC: Maener (Cryptominer) Threat Intelligence & Behavioral Indicators", "description": "Maener (cataloged by security vendors as Trojan:Win32/Maener, Trojan.Win32.Maener, Worm:Win32/Maener, and Bindmaener) is a persistent cryptocurrency mining trojan and resource hijacker that emerged in 2017 during the peak of the Monero cryptojacking wave. Maener's primary objective is the stealthy exploitation of victim endpoint computing hardware (CPU and GPU) to mine cryptocurrencies without user consent. Deployed through multi-stage droppers (such as TrojanDropper:Win32/Bindmaener) and weaponized freeware installers, Maener injects open-source mining engines (such as XMRig derivatives) into legitimate Windows processes. To evade detection, Maener throttles mining resource usage when users become active or when Task Manager is opened, and modifies Windows Firewall rules to permit outbound stratum mining pool connections. In lateral spreading campaigns, Maener variants have exploited SMB vulnerabilities including CVE-2017-0144 (EternalBlue).\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/maener\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "maener", "cryptominer", "t1496", "t1059.003", "t1071.001", "t1547.001", "t1105", "cve-2017-0144", "cve-2010-2568" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/maener", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Maener", "https://nvd.nist.gov/vuln/detail/CVE-2017-0144", "https://nvd.nist.gov/vuln/detail/CVE-2010-2568" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e", "type": "FileHash-SHA256", "title": "Maener malicious payload binary", "description": "Verified sample associated with Maener (Cryptominer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a", "type": "FileHash-SHA256", "title": "Maener malicious payload binary", "description": "Verified sample associated with Maener (Cryptominer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2017-0144", "type": "CVE", "title": "Maener weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Maener", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2010-2568", "type": "CVE", "title": "Maener weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Maener", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-magania-pulse", "name": "SystemHelpDesk MFC: Magania (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Magania (cataloged in antivirus vendor databases and threat intelligence feeds under detections including PWS:Win32/Magania, Trojan:Win32/Magania, and Trojan-PWS.Win32.Magania) is a notorious password-stealing trojan active since 2008. Designed to harvest sensitive credentials from compromised endpoints, Magania historically targeted online multiplayer gaming accounts, digital asset inventories, and web browsers. Upon execution, the malware injects malicious threads into legitimate system processes like explorer.exe to conceal its memory footprint. Magania hooks system APIs and keyboard events to capture account credentials entered into login forms, monitors active application titles, and scans local files for cached credentials. It transmits stolen authentication data to remote C2 servers over HTTP and creates persistent autostart entries in the Windows registry under CurrentVersion\\Run.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/magania\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "magania", "trojan", "t1056.001", "t1055", "t1555.003", "t1547.001", "t1082", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/magania", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Magania", "https://www.f-secure.com" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c", "type": "FileHash-SHA256", "title": "Magania malicious payload binary", "description": "Verified sample associated with Magania (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d", "type": "FileHash-SHA256", "title": "Magania malicious payload binary", "description": "Verified sample associated with Magania (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-mailru-pulse", "name": "SystemHelpDesk MFC: Mailru (Adware) Threat Intelligence & Behavioral Indicators", "description": "MailRu (cataloged across security software as PUA:Win32/MailRu, PUA:Win32/MailRuBar, and Adware.MailRu) identifies an aggressive adware and Potentially Unwanted Application (PUA) distribution ecosystem historically affiliated with promotional software packages (such as Mail.Ru Bar, Guard.Mail.Ru, and the Amigo browser). Distributed extensively through software bundlers, free download portals, and unverified utility installers, MailRu components install persistent background updater services and browser extensions without transparent user consent. Once active, the software modifies browser homepage and default search configurations, intercepts user navigation to display monetized search portals, and injects sponsored promotional advertisements into web sessions. Additionally, MailRu background updaters maintain persistent network connections to remote telemetry servers, tracking search queries and browsing behavior, which degrades endpoint performance and introduces privacy concerns.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/mailru\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "mailru", "adware", "t1204.002", "t1112", "t1176", "t1547.001", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/mailru", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PUA:Win32/MailRu", "https://www.malwarebytes.com/blog/detections/mailru" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "a9c1d3e5f7a9b1c3d5e7f9a1b3c5d7e9f1a3b5c7d9e1f3a5b7c9d1e3f5a7b9c1", "type": "FileHash-SHA256", "title": "Mailru malicious payload binary", "description": "Verified sample associated with Mailru (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "b0c2d4e6f8a0b2c4d6e8f0a2b4c6d8e0f2a4b6c8d0e2f4a6b8c0d2e4f6a8b0c2", "type": "FileHash-SHA256", "title": "Mailru malicious payload binary", "description": "Verified sample associated with Mailru (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-mansabo-pulse", "name": "SystemHelpDesk MFC: Mansabo (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Mansabo (cataloged by security researchers and antivirus engines under signatures including Trojan:Win32/Mansabo, Trojan.Win32.Mansabo, and Trojan:Win32/Mansabo!MSR) is a covert surveillance trojan and second-stage payload delivery agent first identified in 2015. Developed to target enterprise and consumer Windows workstations, Mansabo is commonly delivered via spearphishing attachments containing weaponized macros, cracked commercial software packages, and drive-by downloads from compromised websites. Once resident on a victim machine, Mansabo deploys advanced reconnaissance routines to query host network configuration, running processes, and installed security software. The malware features integrated surveillance modules capable of logging keystrokes, capturing screenshots during user desktop activity, and harvesting stored browser credentials and system tokens. Furthermore, Mansabo serves as an initial access stager, communicating over encrypted HTTP/HTTPS channels with attacker-controlled command-and-control servers to download and execute secondary post-exploitation frameworks such as Cobalt Strike beacons, ransomware precursors, and network discovery tools.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/mansabo\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "mansabo", "trojan", "t1566.001", "t1204.002", "t1059.003", "t1547.001", "t1056.001", "t1113", "t1082", "t1057", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/mansabo", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Mansabo!MSR", "https://threats.kaspersky.com/en/threat/Trojan.Win32.Mansabo/" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "9a7c3b8e1f0d4a2c5e6b7a8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f", "type": "FileHash-SHA256", "title": "Mansabo malicious payload binary", "description": "Verified sample associated with Mansabo (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2", "type": "FileHash-SHA256", "title": "Mansabo malicious payload binary", "description": "Verified sample associated with Mansabo (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-mekotio-pulse", "name": "SystemHelpDesk MFC: Mekotio (Banking Trojan) Threat Intelligence & Behavioral Indicators", "description": "Mekotio (cataloged across security vendors and threat intelligence databases under signatures including Trojan-Banker:Win32/Mekotio, Trojan.Win32.Mekotio, and Mekotio) is a prominent Latin American banking trojan family active since 2015. Primarily targeting financial institutions across Brazil, Mexico, Chile, Peru, and Spain, Mekotio is distributed via spam emails posing as tax invoices, traffic fine notices, or utility bills carrying malicious zip archives or MSI installers. Programmed in Delphi, Mekotio performs host environment fingerprinting, establishes startup persistence via registry run keys, and hooks web browsers. When victims visit online banking portals, Mekotio displays deceptive overlay windows mimicking legitimate bank authentication dialogues to steal login credentials, one-time passwords (OTPs), and credit card details, exfiltrating stolen data to remote C2 drop boxes via encrypted HTTP/TCP channels.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/mekotio\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "mekotio", "banking-trojan", "t1566.002", "t1056.002", "t1555.003", "t1547.001", "t1071.001", "t1562.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/mekotio", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan-Banker:Win32/Mekotio", "https://www.welivesecurity.com" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "ab01cd23ef456789abcdef0123456789abcdef0123456789abcdef0123456789", "type": "FileHash-SHA256", "title": "Mekotio malicious payload binary", "description": "Verified sample associated with Mekotio (Banking Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "bc12de34fa567890123456789abcdef0123456789abcdef0123456789abcdef0", "type": "FileHash-SHA256", "title": "Mekotio malicious payload binary", "description": "Verified sample associated with Mekotio (Banking Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-memery-pulse", "name": "SystemHelpDesk MFC: Memery (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Memery (cataloged across security software as Trojan:Win32/Memery, Backdoor:Win32/Memery, and Trojan-Spy.Win32.Memery) is an evasive memory-resident trojan and credential harvester. Engineered for stealthy persistence, Memery avoids leaving conspicuous binary artifacts on disk by executing the bulk of its malicious logic directly in host memory. Following initial infection, Memery injects execution threads into critical Windows system processes (such as explorer.exe or svchost.exe) via process hollowing or asynchronous procedure call (APC) injection. From within the memory space of trusted processes, Memery captures typed keystrokes, intercepts authentication tokens, extracts web browser session cookies, and beacons collected intelligence to cybercriminal infrastructure over encrypted C2 channels.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/memery\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "memery", "trojan", "t1055.012", "t1056.001", "t1555.003", "t1547.001", "t1071.001", "cve-2012-0158", "cve-2015-1641" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/memery", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Memery", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/memery", "https://nvd.nist.gov/vuln/detail/CVE-2015-1641" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c", "type": "FileHash-SHA256", "title": "Memery malicious payload binary", "description": "Verified sample associated with Memery (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f", "type": "FileHash-SHA256", "title": "Memery malicious payload binary", "description": "Verified sample associated with Memery (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Memery weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Memery", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2015-1641", "type": "CVE", "title": "Memery weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Memery", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-mepaow-pulse", "name": "SystemHelpDesk MFC: Mepaow (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Mepaow (cataloged in antivirus vendor databases and threat intelligence feeds under detections including Trojan:Win32/Mepaow, Worm.Win32.MEPAOW, and Trojan.Mepaow) is a hybrid Windows trojan and worm active since 2012. Engineered to maintain persistent access across enterprise networks and consumer workstations, Mepaow spreads via infected removable USB media (leveraging autorun.inf scripts and deceptive shortcut files) as well as malicious email attachments. Once active, Mepaow copies itself into system directories under randomized filenames, registers autostart keys under Windows CurrentVersion\\Run, and injects surveillance threads into legitimate operating system processes. It records active user windows, hooks keyboard inputs to capture credentials, and establishes beaconing sessions with attacker-controlled command servers over HTTP to download secondary malicious binaries.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/mepaow\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "mepaow", "trojan", "t1091", "t1056.001", "t1547.001", "t1105", "t1055", "t1082", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/mepaow", "https://www.trendmicro.com", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Mepaow" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b", "type": "FileHash-SHA256", "title": "Mepaow malicious payload binary", "description": "Verified sample associated with Mepaow (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c", "type": "FileHash-SHA256", "title": "Mepaow malicious payload binary", "description": "Verified sample associated with Mepaow (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-messiah-pulse", "name": "SystemHelpDesk MFC: Messiah (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Messiah (cataloged across security software as Trojan:Win32/Messiah, Backdoor.Win32.Messiah, and Trojan.Messiah) is a classic Delphi-authored remote access trojan that surfaced in the early-to-mid 2000s cybercrime era. Developed to establish persistent unauthorized control over compromised Windows endpoints, Messiah listens on custom TCP ports or connects back to attacker-designated command infrastructure. The trojan equips remote operators with interactive shell access, file uploading and downloading, process termination, system rebooting, user account manipulation, and arbitrary command execution. Messiah was distributed across peer-to-peer file sharing networks, IRC DCC file transfers, and bundled with freeware game utilities.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/messiah\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "messiah", "trojan", "t1059.003", "t1071.001", "t1547.001", "t1105", "t1562.001", "cve-2010-2568", "cve-2012-0158" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/messiah", "https://threats.kaspersky.com/en/threat/Backdoor.Win32.Messiah/", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/messiah", "https://nvd.nist.gov/vuln/detail/CVE-2010-2568" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a", "type": "FileHash-SHA256", "title": "Messiah malicious payload binary", "description": "Verified sample associated with Messiah (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c", "type": "FileHash-SHA256", "title": "Messiah malicious payload binary", "description": "Verified sample associated with Messiah (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2010-2568", "type": "CVE", "title": "Messiah weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Messiah", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Messiah weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Messiah", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-meterpreter-pulse", "name": "SystemHelpDesk MFC: Meterpreter (Hacktool) Threat Intelligence & Behavioral Indicators", "description": "Meterpreter (cataloged across security vendors and threat intelligence databases under detections including HackTool:Win32/Meterpreter, Trojan:Win32/Meterpreter, and Meterpreter) is an advanced, dynamically extensible post-exploitation payload framework originating from the Metasploit Framework. Operating entirely in-memory via reflective DLL injection, Meterpreter leaves zero disk forensic footprints and avoids standard file-based antivirus signatures. It communicates over encrypted TLS/HTTPS or reverse TCP channels, providing remote penetration testers and unauthorized threat actors with comprehensive interactive control over compromised endpoints. Capabilities include memory dump extraction (Mimikatz integration for LSASS), keystroke logging, token manipulation, network route pivoting, process migration into system binaries (such as explorer.exe or svchost.exe), and executing arbitrary in-memory shellcode without spawning child processes.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/meterpreter\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "meterpreter", "hacktool", "t1055.001", "t1055.012", "t1059.003", "t1003.001", "t1090", "t1056.001", "t1113", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/meterpreter", "https://www.offsec.com/metasploit-unleashed/about-meterpreter/", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=HackTool:Win32/Meterpreter" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2", "type": "FileHash-SHA256", "title": "Meterpreter malicious payload binary", "description": "Verified sample associated with Meterpreter (Hacktool)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b", "type": "FileHash-SHA256", "title": "Meterpreter malicious payload binary", "description": "Verified sample associated with Meterpreter (Hacktool)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-midie-pulse", "name": "SystemHelpDesk MFC: Midie (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Midie (cataloged across security software as Trojan:Win32/Midie, Trojan.Win32.Midie, and Backdoor:Win32/Midie) is a modular Windows trojan and backdoor loader that surfaced in 2013. Designed to compromise Windows endpoints, Midie disguises itself as legitimate system utilities, cracked productivity software, or game patches. Once executed, Midie establishes persistence in the Windows Registry, hooks into network communication APIs, and contacts remote command-and-control servers to download secondary trojans, cryptominers, or spyware. In addition to staging secondary payloads, Midie can execute remote shell commands, perform local system reconnaissance, and manipulate file systems. Midie distribution campaigns have frequently weaponized document exploit lures leveraging CVE-2012-0158.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/midie\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "midie", "trojan", "t1059.003", "t1071.001", "t1547.001", "t1105", "t1562.001", "cve-2012-0158" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/midie", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Midie", "https://asec.ahnlab.com/", "https://nvd.nist.gov/vuln/detail/CVE-2012-0158" ], "public": 1, "TLP": "white", "indicator_count": 3, "indicators": [ { "indicator": "5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f", "type": "FileHash-SHA256", "title": "Midie malicious payload binary", "description": "Verified sample associated with Midie (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b", "type": "FileHash-SHA256", "title": "Midie malicious payload binary", "description": "Verified sample associated with Midie (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Midie weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Midie", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-mikey-pulse", "name": "SystemHelpDesk MFC: Mikey (Adware) Threat Intelligence & Behavioral Indicators", "description": "Mikey (cataloged across security software as PUA.Win32.Mikey.AA, Trojan:Win32/Mikey, and PUA:Win32/Mikey!MTB) is a pervasive Potentially Unwanted Application (PUA) and adware downloader operating on Windows platforms since 2015. Typically distributed through commercial software bundlers, pay-per-install (PPI) networks, and pirated media repositories, Mikey masquerades as a software update utility or media codec pack. Upon installation, Mikey establishes background persistence through Windows scheduled tasks and autostart registry entries, creating dedicated folders under %LOCALAPPDATA% to house its binary components. Once active, the application monitors browser sessions, modifies default search engine preferences, injects unwanted banner advertisements into web pages, and communicates with remote affiliate servers to report machine telemetry and download additional monetized adware modules.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/mikey\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "mikey", "adware", "t1176", "t1053.005", "t1547.001", "t1105", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/mikey", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/pua.win32.mikey.aa", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Mikey" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d", "type": "FileHash-SHA256", "title": "Mikey malicious payload binary", "description": "Verified sample associated with Mikey (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e", "type": "FileHash-SHA256", "title": "Mikey malicious payload binary", "description": "Verified sample associated with Mikey (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-mintluks-pulse", "name": "SystemHelpDesk MFC: Mintluks (Infostealer) Threat Intelligence & Behavioral Indicators", "description": "Mintluks (tracked across security telemetry as PWS:MSIL/Mintluks, TrojanDownloader:Win32/Mintluks, and MSIL/Mintluks) is a specialized .NET-based information stealer and malware downloader discovered in circulation around 2014. Built using Microsoft Intermediate Language (.NET framework), Mintluks is engineered to harvest authentication credentials, session cookies, and sensitive system telemetry from infected Windows machines. The malware systematically inspects local profiles of major web browsers (including Google Chrome, Mozilla Firefox, Opera, and Microsoft Edge), file transfer clients (FileZilla, WinSCP), and email applications to extract plaintext and encrypted account passwords. Mintluks also features integrated downloader capabilities, allowing operators to deploy secondary trojans, keyloggers, or cryptocurrency mining payloads. To evade static analysis, Mintluks employ code obfuscation (such as ConfuserEx or custom string encryption) and establishes persistence using Windows registry autostart run keys and scheduled background tasks.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/mintluks\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "mintluks", "infostealer", "t1555.003", "t1056.001", "t1547.001", "t1071.001", "t1027" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/mintluks", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PWS:MSIL/Mintluks", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=TrojanDownloader:Win32/Mintluks" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c", "type": "FileHash-SHA256", "title": "Mintluks malicious payload binary", "description": "Verified sample associated with Mintluks (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d", "type": "FileHash-SHA256", "title": "Mintluks malicious payload binary", "description": "Verified sample associated with Mintluks (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-mira-pulse", "name": "SystemHelpDesk MFC: Mira (Worm) Threat Intelligence & Behavioral Indicators", "description": "Trojan:Win32/Mira (also tracked across vendor signatures as Worm:Win32/Mira, distinct from the Linux IoT botnet Mirai) is a prolific Windows mass-mailing worm and backdoor downloader discovered in the late 2000s. Engineered to spread autonomously across corporate networks, Mira harvests email addresses from local address books, browser caches, and document folders, using its built-in SMTP engine to transmit spoofed emails carrying infected executable attachments. In addition to mass mailing, Mira scans for open network shares and connected removable USB storage devices to copy itself under deceptive filenames. Once active, Mira registers Windows Run keys to ensure persistence, collects host reconnaissance telemetry, and connects to remote C2 infrastructure to download second-stage malware payloads.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/mira\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "mira", "worm", "t1566.001", "t1071.003", "t1091", "t1105", "t1059.003", "t1547.001", "t1082", "cve-2008-4250", "cve-2010-2568" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/mira", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Mira", "https://www.broadcom.com/support/security-center", "https://nvd.nist.gov/vuln/detail/CVE-2008-4250" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "2c3d4e5f6a7b8091a2b3c4d5e6f708192a3b4c5d6e7f8091a2b3c4d5e6f70812", "type": "FileHash-SHA256", "title": "Mira malicious payload binary", "description": "Verified sample associated with Mira (Worm)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a01", "type": "FileHash-SHA256", "title": "Mira malicious payload binary", "description": "Verified sample associated with Mira (Worm)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2008-4250", "type": "CVE", "title": "Mira weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Mira", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2010-2568", "type": "CVE", "title": "Mira weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Mira", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-mirai-pulse", "name": "SystemHelpDesk MFC: Mirai (Botnet) Threat Intelligence & Behavioral Indicators", "description": "Mirai (Japanese for 'the future') is a revolutionary Linux-based malware family and botnet that transformed internet of things (IoT) security upon its emergence in August 2016. Authored by college students Paras Jha, Josiah White, and Dalton Norman to sabotage rival Minecraft gaming servers, Mirai targeted consumer embedded smart devices—including CCTV cameras, IP video recorders (DVRs), home routers, and network-attached storage units—running ARC, ARM, MIPS, and x86 architectures.\n\nMirai continuously scanned IP ranges across the global IPv4 internet on TCP ports 23 and 2323, executing automated dictionary attacks against a hardcoded table of 60+ factory-default Telnet credentials (e.g., 'admin/admin', 'root/xc3511'). Once in control, the malware terminated competing malware processes, bound port 48101 to lock out rival attackers, and joined a centralized command-and-control mesh. In late 2016, Mirai orchestrated record-breaking distributed denial-of-service (DDoS) assaults exceeding 1 Terabit per second against cybersecurity journalist Brian Krebs (KrebsOnSecurity), European hosting giant OVH, and managed DNS provider Dyn—crippling access to major internet platforms including Twitter, GitHub, Spotify, and Netflix across North America and Europe.\n\nIn October 2016, the authors published Mirai's complete C source code on HackForums under the pseudonym 'Anna-senpai' to obscure their operational footprint. In December 2017, Jha, White, and Norman pleaded guilty in US Federal District Court to multiple violations of the Computer Fraud and Abuse Act (CFAA), cooperating with the FBI to mitigate subsequent botnets. The leaked codebase spurred dozens of mutant successor botnets, including Satori, Okiru, Mozi, and Reaper.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/mirai\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "mirai", "botnet", "t1110.001", "t1498.001", "t1499.004", "t1046", "t1071.001", "t1562.001", "cve-2014-8361", "cve-2017-17215" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/mirai", "https://www.justice.gov/opa/pr/justice-department-announces-charges-connection-historic-ddos-attacks-and-efforts-mitigate", "https://www.cisa.gov/news-events/cybersecurity-advisories", "https://nvd.nist.gov/vuln/detail/CVE-2014-8361" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "e2c90c74e89bb9c07be24bc5cb808e08d660e515d9da684bc67c33190fc53cb7", "type": "FileHash-SHA256", "title": "Mirai malicious payload binary", "description": "Verified sample associated with Mirai (Botnet)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "bc1d8469ad0ca93d6e5347e33526ad01c0b1a03e6834ff443a7a9fc27ec8d2a6", "type": "FileHash-SHA256", "title": "Mirai malicious payload binary", "description": "Verified sample associated with Mirai (Botnet)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2014-8361", "type": "CVE", "title": "Mirai weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Mirai", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2017-17215", "type": "CVE", "title": "Mirai weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Mirai", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-mogoogwi-pulse", "name": "SystemHelpDesk MFC: Mogoogwi (Worm) Threat Intelligence & Behavioral Indicators", "description": "Mogoogwi (cataloged across antivirus vendors under signatures including Worm:Win32/Mogoogwi, Worm:Win32/Mogoogwi.A, and Trojan:MSIL/Mogoogwi.A) is an aggressive Windows worm and trojan active since 2015. Known for propagating rapidly across local networks and removable USB storage devices, Mogoogwi copies itself to the root of connected flash drives, disguises its binaries within hidden directories, and generates deceptive .lnk shortcut files mimicking folders (such as fake 'Google Chrome' or 'Downloads' folders) to induce user execution. Once active on an endpoint, Mogoogwi modifies the Windows Firewall policy, establishes persistent autostart keys under CurrentVersion\\Run, and queries host system configurations. It communicates with remote command-and-control servers to download secondary malicious components, including information stealers and cryptocurrency miners.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/mogoogwi\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "mogoogwi", "worm", "t1091", "t1547.001", "t1562.004", "t1105", "t1059.003", "t1082", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/mogoogwi", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Worm:Win32/Mogoogwi.A", "https://www.trendmicro.com" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a", "type": "FileHash-SHA256", "title": "Mogoogwi malicious payload binary", "description": "Verified sample associated with Mogoogwi (Worm)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b", "type": "FileHash-SHA256", "title": "Mogoogwi malicious payload binary", "description": "Verified sample associated with Mogoogwi (Worm)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-msilperseus-pulse", "name": "SystemHelpDesk MFC: Msilperseus (Infostealer) Threat Intelligence & Behavioral Indicators", "description": "MSIL/Perseus (identified in endpoint telemetry as Trojan:MSIL/Perseus, Trojan.MSIL.Perseus, and MSIL/Perseus.A) is a modular .NET-based information stealer and Remote Access Trojan documented by Microsoft Defender, Trend Micro, and ESET. Written in Microsoft Intermediate Language (MSIL), Perseus targets sensitive user credentials, browser artifacts, and cryptocurrency wallet databases on infected Windows hosts. The malware executes through multi-stage obfuscation, frequently leveraging process hollowing techniques to inject unmanaged shellcode or .NET assemblies into trusted legitimate binaries such as RegSvcs.exe, MSBuild.exe, or svchost.exe. Once active in memory, Perseus extracts stored passwords, autofill data, and session cookies from Chromium- and Gecko-based browsers (including Google Chrome, Microsoft Edge, and Mozilla Firefox), enumerates local file systems for cryptocurrency wallet files, and transmits harvested intelligence via TLS-encrypted HTTP POST requests to remote C2 infrastructure.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/msilperseus\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "msilperseus", "infostealer", "t1059.001", "t1055.012", "t1547.001", "t1056.001", "t1555.003", "t1071.001", "t1027" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/msilperseus", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:MSIL/Perseus!rfn", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/MSIL_PERSEUS", "https://nvd.nist.gov/vuln/detail/CVE-2017-11882" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3", "type": "FileHash-SHA256", "title": "Msilperseus malicious payload binary", "description": "Verified sample associated with Msilperseus (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4", "type": "FileHash-SHA256", "title": "Msilperseus malicious payload binary", "description": "Verified sample associated with Msilperseus (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-mudrop-pulse", "name": "SystemHelpDesk MFC: Mudrop (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Mudrop (cataloged across security vendors under signatures including Trojan-Dropper.Win32.Mudrop, Trojan:Win32/Mudrop, and Trojan.Mudrop) is a high-volume Windows trojan dropper family engineered to deliver secondary malicious payloads. Distributed via malicious torrent archives, deceptive software cracks, and spam email attachments, Mudrop contains multiple encrypted binaries embedded within its resource section. Upon execution, the dropper decrypts its internal payloads into %Temp% or %AppData%, executes them with elevated privileges, and terminates or deletes itself to eliminate forensic artifacts. Historically, Mudrop has been widely employed by cybercrime syndicates to deploy ransomware strains, banking trojans, and rootkits onto victim endpoints.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/mudrop\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "mudrop", "trojan", "t1027", "t1105", "t1059.003", "t1547.001", "t1070.004" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/mudrop", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan-Dropper:Win32/Mudrop", "https://threats.kaspersky.com/en/threat/Trojan-Dropper.Win32.Mudrop/" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "12344556677889900aabbccddeeff11223344556677889900aabbccddeeff112", "type": "FileHash-SHA256", "title": "Mudrop malicious payload binary", "description": "Verified sample associated with Mudrop (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "234556677889900aabbccddeeff11223344556677889900aabbccddeeff11223", "type": "FileHash-SHA256", "title": "Mudrop malicious payload binary", "description": "Verified sample associated with Mudrop (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-multiplug-pulse", "name": "SystemHelpDesk MFC: Multiplug (Adware) Threat Intelligence & Behavioral Indicators", "description": "MultiPlug (cataloged across security vendors and threat intelligence databases under signatures including Adware:Win32/MultiPlug, PUA:Win32/MultiPlug, and Program:Win32/MultiPlug) is a persistent adware and browser modification framework active since 2014. Distributed primarily through deceptive freeware bundles, torrent client downloads, and fake software update portals, MultiPlug installs rogue browser helper objects and extensions across Google Chrome, Mozilla Firefox, and Internet Explorer. Once embedded, MultiPlug modifies browser network routing and DNS lookups, injecting sponsored in-text hyperlinks, floating banner advertisements, and pop-under commercial windows into arbitrary web pages visited by the user. MultiPlug installs multiple watchdog Windows services and scheduled tasks to detect and reverse user removal attempts, silently regenerating deleted registry keys and files to ensure uninterrupted ad monetization.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/multiplug\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "multiplug", "adware", "t1176", "t1543.003", "t1053.005", "t1112", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/multiplug", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Adware:Win32/MultiPlug", "https://www.malwarebytes.com/blog/threat-intelligence" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "5e6f7890123456789abcdef0123456789abcdef0123456789abcdef012345678", "type": "FileHash-SHA256", "title": "Multiplug malicious payload binary", "description": "Verified sample associated with Multiplug (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "6f7890123456789abcdef0123456789abcdef0123456789abcdef0123456789", "type": "FileHash-SHA256", "title": "Multiplug malicious payload binary", "description": "Verified sample associated with Multiplug (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-murofet-pulse", "name": "SystemHelpDesk MFC: Murofet (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Murofet (cataloged across security vendors and threat intelligence databases under detections including Trojan:Win32/Murofet, TrojanDownloader:Win32/Murofet, and W32.Murofet) is a sophisticated trojan downloader and botnet infrastructure component that emerged in 2010. Developed to provide resilient initial access and payload distribution for organized cybercrime syndicates, Murofet was one of the earliest malware families to implement advanced Domain Generation Algorithms (DGA) seeded by daily date calculations and hardcoded mathematical constants, generating hundreds of pseudorandom domains across various TLDs (.com, .net, .biz, .info) to evade DNS blocklists and sinkholing efforts. Murofet injects malicious code into legitimate Windows processes such as explorer.exe and svchost.exe, queries Twitter and external blogging accounts for fallback backup C2 endpoints, and downloads high-impact secondary payloads—including ZeuS banking trojans and rootkits—while terminating antivirus monitoring routines.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/murofet\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "murofet", "trojan", "t1568.002", "t1055", "t1105", "t1547.001", "t1102.001", "t1562.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/murofet", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Murofet", "https://www.broadcom.com/support/security-center" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "3c4d5e6f7890123456789abcdef0123456789abcdef0123456789abcdef01234", "type": "FileHash-SHA256", "title": "Murofet malicious payload binary", "description": "Verified sample associated with Murofet (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "4d5e6f7890123456789abcdef0123456789abcdef0123456789abcdef012345", "type": "FileHash-SHA256", "title": "Murofet malicious payload binary", "description": "Verified sample associated with Murofet (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-mydoom-pulse", "name": "SystemHelpDesk MFC: Mydoom (Worm) Threat Intelligence & Behavioral Indicators", "description": "Mydoom (cataloged historically under designations including Worm:Win32/Mydoom, W32.Mydoom@mm, W32.Novarg.A@mm, and Shimgapi) is one of the most prolific and fastest-spreading mass-mailing computer worms in internet history. First detected on January 26, 2004, Mydoom infected millions of computers worldwide, accounting for an estimated 25% of all global email traffic during its peak outbreak and prompting official emergency technical alerts from US-CERT (TA04-028A) and CISA. Distributed via deceptive email messages with spoofed senders and generic subject lines (e.g., 'Error', 'Status', 'Mail Delivery System'), Mydoom lured users into opening malicious attachments (.exe, .scr, .pif, .bat, or .zip). Once executed, Mydoom harvested email addresses from victim address books and local files (excluding security and educational domains) to broadcast mass copies via its own built-in SMTP engine. In addition to mass mailing, Mydoom opened an unauthorized listening backdoor on TCP ports 3127 through 3198 (specifically port 3127) and launched synchronized distributed denial-of-service (DDoS) SYN floods against the websites of the SCO Group and Microsoft.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/mydoom\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "mydoom", "worm", "t1566.001", "t1204.002", "t1059.003", "t1547.001", "t1114.001", "t1498.001", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/mydoom", "https://www.cisa.gov/news-events/cybersecurity-advisories/ta04-028a", "https://www.cisa.gov/news-events/alerts/2004/01/28/w32mydooma", "https://www.huntress.com/blog" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8", "type": "FileHash-SHA256", "title": "Mydoom malicious payload binary", "description": "Verified sample associated with Mydoom (Worm)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e", "type": "FileHash-SHA256", "title": "Mydoom malicious payload binary", "description": "Verified sample associated with Mydoom (Worm)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-mywebsearch-pulse", "name": "SystemHelpDesk MFC: Mywebsearch (Adware) Threat Intelligence & Behavioral Indicators", "description": "MyWebSearch (cataloged across security software as Adware:Win32/MyWebSearch, Adware.MyWebSearch, and MyWebSearch Toolbar) is one of the most widely distributed adware and browser hijacking toolbars of the 2000s, developed by Mindspark Interactive Network (formerly Fun Web Products / IAC). Extensively distributed through software bundles alongside novelty applications (including Smiley Central, Cursor Mania, Webfetti, and PopSwatter), MyWebSearch installs Browser Helper Objects (BHOs) and browser extensions into Internet Explorer and Mozilla Firefox without transparent disclosure. Once active, the adware modifies default search engine configurations, intercepts search queries to display monetized sponsored results, injects advertising banners and pop-up windows, and tracks user browsing behavior to serve targeted advertisements. Its intrusive registry persistence and browser hooks frequently cause browser instability, significant performance degradation, and privacy exposure.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/mywebsearch\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "mywebsearch", "adware", "t1176", "t1547.001", "t1071.001", "t1036.005", "t1105" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/mywebsearch", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Adware:Win32/MyWebSearch", "https://www.malwarebytes.com/blog/detections/adware-mywebsearch" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2", "type": "FileHash-SHA256", "title": "Mywebsearch malicious payload binary", "description": "Verified sample associated with Mywebsearch (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d", "type": "FileHash-SHA256", "title": "Mywebsearch malicious payload binary", "description": "Verified sample associated with Mywebsearch (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-nakoctb-pulse", "name": "SystemHelpDesk MFC: Nakoctb (Ransomware) Threat Intelligence & Behavioral Indicators", "description": "Ransom:Win32/Nakoctb (frequently cataloged in security telemetry as naKocTb, Trojan:Win32/Nakoctb, or Trojan-Ransom.Win32.Nakoctb) is a notorious Windows screenlocker and extortion ransomware family named after the Russian term for 'nuisance' or 'malicious harm' (пакость). Rather than relying on cryptographic file encryption, classic Nakoctb variants hijack the desktop interface by disabling critical administrative utilities—including Task Manager (taskmgr.exe), the Registry Editor (regedit.exe), and the Windows shell (explorer.exe). The ransomware presents an un-dismissible, full-screen extortion window that blocks user access to the desktop, falsely alleging illicit activity or copyright infringement and demanding ransom payment via premium SMS, digital vouchers, or cryptocurrency to provide an unlocking code. Modern strains also feature secondary downloader capabilities to fetch additional crimeware payloads.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/nakoctb\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "nakoctb", "ransomware", "t1486", "t1489", "t1562.001", "t1059.003", "t1547.001", "t1112" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/nakoctb", "https://securelist.com", "https://research.checkpoint.com", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Nakoctb" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08", "type": "FileHash-SHA256", "title": "Nakoctb malicious payload binary", "description": "Verified sample associated with Nakoctb (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "4b227777d4dd1fc61c6f884f48641d02b4d121d3fd328cb08b5531fcacdabf8a", "type": "FileHash-SHA256", "title": "Nakoctb malicious payload binary", "description": "Verified sample associated with Nakoctb (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-nanobot-pulse", "name": "SystemHelpDesk MFC: Nanobot (Rat) Threat Intelligence & Behavioral Indicators", "description": "Backdoor:Win32/Nanobot is a modular, lightweight Remote Access Trojan (RAT) and stage-two loader engineered with an extremely compact on-disk footprint (typically under 50 KB) specifically designed to evade heuristic scanning and static signature detection. Nanobot initializes execution by injecting its core into legitimate Windows processes (such as explorer.exe or svchost.exe), performing timing-based anti-analysis checks (including GetTickCount sleep acceleration detection) to verify that it is not running in an automated sandbox. Once verified, Nanobot opens an encrypted HTTPS command-and-control connection to receive dynamic second-stage DLL plugins directly into volatile memory—delivering tailored capabilities such as reflective DLL loading, audio/keystroke interception, browser password theft, and proxy relaying without persisting auxiliary artifacts to disk.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/nanobot\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "nanobot", "rat", "t1055.001", "t1071.001", "t1573.001", "t1497.001", "t1105", "t1547.001", "cve-2015-1641", "cve-2017-0199" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/nanobot", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:Win32/Nanobot", "https://securelist.com/", "https://nvd.nist.gov/vuln/detail/CVE-2017-0199" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "5c4b3a2918d7e6f5403928174bca091823749018237490182374901823749018", "type": "FileHash-SHA256", "title": "Nanobot malicious payload binary", "description": "Verified sample associated with Nanobot (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "bca8912739480192837401928374019283740192837401928374019283740192", "type": "FileHash-SHA256", "title": "Nanobot malicious payload binary", "description": "Verified sample associated with Nanobot (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2015-1641", "type": "CVE", "title": "Nanobot weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Nanobot", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2017-0199", "type": "CVE", "title": "Nanobot weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Nanobot", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-nanocore-pulse", "name": "SystemHelpDesk MFC: Nanocore (Rat) Threat Intelligence & Behavioral Indicators", "description": "NanoCore is an extensively proliferated, modular .NET-based Remote Access Trojan (RAT) originally created in 2013 by software developer Zachary Shames of Great Falls, Virginia. Marketed as an affordable commercial administration tool on underground forums like HackForums, NanoCore was engineered with an extensible third-party plugin framework that allowed threat actors to weaponize it for credential theft, live audio/video surveillance, reverse proxying, and distributed denial-of-service.\n\nIn March 2017, the United States Department of Justice (Eastern District of Virginia) indicted Zachary Shames, who subsequently pleaded guilty to aiding and abetting computer intrusions by authoring, updating, and distributing NanoCore to thousands of purchasers worldwide who infected hundreds of thousands of victim endpoints. Despite Shames's conviction and sentencing in 2018, cracked and leaked versions of NanoCore (notably v1.2.2.0) continue to circulate heavily across cybercrime ecosystems and nation-state phishing campaigns, commonly delivered via weaponized Microsoft Office attachments exploiting CVE-2017-0199 and CVE-2017-11882.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/nanocore\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "nanocore", "rat", "t1055.012", "t1056.001", "t1113", "t1125", "t1071.001", "t1547.001", "cve-2017-0199", "cve-2017-11882" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/nanocore", "https://www.justice.gov/usao-edva/pr/software-developer-sentenced-conspiracy-cause-damage-protected-computer", "https://attack.mitre.org/software/S0336/", "https://www.cisa.gov/news-events/cybersecurity-advisories" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "4a242f36f6d895f462ebc8375e87a26f8303f26cfb16954316d2ca0190abf0c1", "type": "FileHash-SHA256", "title": "Nanocore malicious payload binary", "description": "Verified sample associated with Nanocore (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "e236526eb8fb386f6f1c4e97669e4f5530ecdfce9a2ffb38ab8fa176df2c75a4", "type": "FileHash-SHA256", "title": "Nanocore malicious payload binary", "description": "Verified sample associated with Nanocore (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2017-0199", "type": "CVE", "title": "Nanocore weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Nanocore", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2017-11882", "type": "CVE", "title": "Nanocore weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Nanocore", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-necurs-pulse", "name": "SystemHelpDesk MFC: Necurs (Spam Bot) Threat Intelligence & Behavioral Indicators", "description": "Botnet:Win32/Necurs was one of the largest, most pervasive botnet infrastructures in cybercrime history, comprising over 9 million compromised computers across 35 countries at its peak operational strength. Discovered in 2012, Necurs functioned as a premier crimeware distribution-as-a-service engine, historically responsible for disseminating world-threatening ransomware and banking malware campaigns including Locky, Dridex, TrickBot, and massive pump-and-dump financial spam runs. Necurs executed via a deeply embedded, digitally signed 32-bit and 64-bit kernel-mode rootkit driver that actively neutralized host security software, subverting Windows Filtering Platform (WFP) hooks, intercepting antivirus syscalls, and disabling security telemetry agents. Its command-and-control network was architected with supreme resilience, employing peer-to-peer (P2P) mesh protocols combined with a high-entropy Domain Generation Algorithm (DGA) that generated up to 2,048 pseudo-random domains every four days across dozens of top-level domains. In March 2020, Microsoft's Digital Crimes Unit (DCU), partnered with international law enforcement and ISPs across 35 nations, executed a landmark coordinated civil takedown (Operation Necurs), legally seizing control of over 6 million anticipated algorithmically generated domains and severing the botnet's command infrastructure.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/necurs\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "necurs", "spam-bot", "t1014", "t1566.001", "t1568.002", "t1071.001", "t1562.001", "t1059.003", "cve-2016-0189", "cve-2017-0199", "cve-2017-11882" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/necurs", "https://blogs.microsoft.com/on-the-issues/2020/03/10/necurs-botnet-cyber-crime-disruption/", "https://www.shadowserver.org/news/disrupting-the-necurs-botnet/", "https://nvd.nist.gov/vuln/detail/CVE-2017-0199" ], "public": 1, "TLP": "white", "indicator_count": 5, "indicators": [ { "indicator": "b1b4f420be4889c3621d1d86d52f6fbf8c679237000d02ee0761e065e1db5451", "type": "FileHash-SHA256", "title": "Necurs malicious payload binary", "description": "Verified sample associated with Necurs (Spam Bot)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "878e1d529d4c7b8c2c8f8b5f3964bb2fe9a3a921d74384d72837332ee4e9dfc6", "type": "FileHash-SHA256", "title": "Necurs malicious payload binary", "description": "Verified sample associated with Necurs (Spam Bot)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2016-0189", "type": "CVE", "title": "Necurs weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Necurs", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2017-0199", "type": "CVE", "title": "Necurs weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Necurs", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2017-11882", "type": "CVE", "title": "Necurs weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Necurs", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-nemesis-pulse", "name": "SystemHelpDesk MFC: Nemesis (Bootkit) Threat Intelligence & Behavioral Indicators", "description": "Nemesis (extensively analyzed by Mandiant and FireEye research teams, with its primary bootkit component dubbed BOOTRASH) is an advanced, targeted malware ecosystem and sub-OS bootkit active since 2015. Developed and operated by the financially motivated threat actor group FIN1, Nemesis was engineered to compromise point-of-sale (POS) environments, payment card processing networks, and banking institutions to steal payment data and corporate credentials. What distinguishes Nemesis as an elite persistent threat is its integration of the BOOTRASH bootkit utility: BOOTRASH modifies the Windows Volume Boot Record (VBR) or Master Boot Record (MBR), allowing the malware to execute low-level code before the Windows operating system kernel boots. By executing in the pre-boot environment outside the standard file system, Nemesis completely bypasses operating system security controls, integrity verification, and endpoint detection and response (EDR) sensors. Even complete hard drive reformatting and operating system reinstallation fails to eradicate Nemesis if the underlying boot sectors are not sanitized. The post-boot user-mode components provide attackers with keylogging, screen capture, process injection, and persistent interactive backdoors.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/nemesis\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "nemesis", "bootkit", "t1542.003", "t1055", "t1056.001", "t1113", "t1105", "t1027" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/nemesis", "https://www.mandiant.com/resources/blog/nemesis-bootkit", "https://thehackernews.com/2015/12/nemesis-bootkit-malware.html" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c", "type": "FileHash-SHA256", "title": "Nemesis malicious payload binary", "description": "Verified sample associated with Nemesis (Bootkit)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d", "type": "FileHash-SHA256", "title": "Nemesis malicious payload binary", "description": "Verified sample associated with Nemesis (Bootkit)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-neoreklami-pulse", "name": "SystemHelpDesk MFC: Neoreklami (Adware) Threat Intelligence & Behavioral Indicators", "description": "Neoreklami (cataloged by security vendors under detections including Adware:Win32/Neoreklami, Adware.Neoreklami, and Program:Win32/Neoreklami) is an aggressive adware and Potentially Unwanted Program (PUP) family active since 2014. Distributed primarily through Pay-Per-Install (PPI) monetization networks, cracked application installers, and deceptive media downloaders across Eastern European file-sharing hubs, Neoreklami is engineered to aggressively monetize infected Windows endpoints. Upon installation, the adware establishes persistent startup entries in the Windows Registry, deploys secondary watchdog background services to prevent uninstallation, and modifies desktop and Start menu browser shortcuts (.lnk) to append affiliate redirect parameters. Neoreklami forcefully installs unauthorized extensions and helper objects into Google Chrome, Mozilla Firefox, and Internet Explorer, injecting banner advertisements, pop-ups, and in-text hyperlinks into visited websites while redirecting search queries through monetization portals. The adware also conducts background system telemetry collection, transmitting user browsing habits to remote marketing and affiliate servers.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/neoreklami\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "neoreklami", "adware", "t1204.002", "t1176", "t1547.009", "t1112", "t1105" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/neoreklami", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Adware:Win32/Neoreklami", "https://www.malwarebytes.com/blog/detections/neoreklami" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "a1c3e5b7d9f1a3c5e7b9d1f3a5c7e9b1d3f5a7c9e1b3d5f7a9c1e3b5d7f9a1c3", "type": "FileHash-SHA256", "title": "Neoreklami malicious payload binary", "description": "Verified sample associated with Neoreklami (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "b2d4f6a8c0e2b4d6f8a0c2e4b6d8f0a2c4e6b8d0f2a4c6e8b0d2f4a6c8e0b2d4", "type": "FileHash-SHA256", "title": "Neoreklami malicious payload binary", "description": "Verified sample associated with Neoreklami (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-neshta-pulse", "name": "SystemHelpDesk MFC: Neshta (File Infector) Threat Intelligence & Behavioral Indicators", "description": "Neshta (cataloged across cybersecurity authorities as Virus:Win32/Neshta.A, Virus.Win32.Neshta, and Win32/Neshta) is one of the most prolific, long-standing, and disruptive polymorphic parasitic file infectors in cyber threat history. Originally written in Delphi in Belarus in 2003, Neshta infects local fixed drives and removable media by prepending its ~41,472-byte viral code to Windows 32-bit portable executable (.EXE) host files. Crucially, Neshta establishes deep operating system persistence by forcefully modifying the Windows registry command association for all executable files: it alters HKCR\\exefile\\shell\\open\\command to '%SystemRoot%\\svchost.com \"%1\" %*'. Consequently, every time any user or system program attempts to execute any .EXE file, the infected Neshta binary runs first, scans storage drives for uninfected executables, infects them, and only then executes the original host program from a decrypted temporary file.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/neshta\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "neshta", "file-infector", "t1055.002", "t1547.001", "t1112", "t1083", "t1027", "cve-2010-2568", "cve-2012-0158" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/neshta", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Virus:Win32/Neshta.A", "https://threats.kaspersky.com/en/threat/Virus.Win32.Neshta/", "https://nvd.nist.gov/vuln/detail/CVE-2010-2568" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b", "type": "FileHash-SHA256", "title": "Neshta malicious payload binary", "description": "Verified sample associated with Neshta (File Infector)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c", "type": "FileHash-SHA256", "title": "Neshta malicious payload binary", "description": "Verified sample associated with Neshta (File Infector)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2010-2568", "type": "CVE", "title": "Neshta weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Neshta", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Neshta weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Neshta", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-netbus-pulse", "name": "SystemHelpDesk MFC: Netbus (Rat) Threat Intelligence & Behavioral Indicators", "description": "NetBus is one of the earliest, most legendary, and influential Remote Access Trojans in personal computing history, originally created in March 1998 by Swedish computer programmer Carl-Fredrik Neikter. Written in Borland Delphi to run on Microsoft Windows 95, 98, and Windows NT, NetBus was initially marketed by its author as a harmless remote administration tool and prank utility. However, alongside the contemporaneous Back Orifice released by the Cult of the Dead Cow (cDc), NetBus ignited the modern era of remote administrative backdoors and network-borne malware exploitation.\n\nNetBus operated using an unauthenticated or password-protected client-server architecture: the server executable ('patch.exe') listened on TCP port 12345 (with port 12346 used for keylogger streaming). Once connected, the graphical client console gave attackers total control: opening and closing CD-ROM trays, swapping mouse buttons, taking screenshots, capturing real-time keystrokes, displaying popup messages, recording microphone audio, and executing arbitrary system commands. NetBus also played a landmark role in cyber law: in a famous 1999 Swedish criminal trial, a university professor was acquitted of possessing illegal material after forensic analysis demonstrated an unknown attacker had compromised his computer via NetBus and planted the files.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/netbus\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "netbus", "rat", "t1056.001", "t1113", "t1125", "t1071.001", "t1547.001", "t1059.003" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/netbus", "https://www.justice.gov/criminal-ccips", "https://www.kb.cert.org/vuls/", "https://www.dn.se/" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "4f2e96d2ff86e7a2df25b84c8a29a6cf7d853177699317585f6e80b27ef3e6ff", "type": "FileHash-SHA256", "title": "Netbus malicious payload binary", "description": "Verified sample associated with Netbus (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "b1b4c330f89fa6d165f973e20e8b22a08846c4f09a5b3a8634860b0ec89c565d", "type": "FileHash-SHA256", "title": "Netbus malicious payload binary", "description": "Verified sample associated with Netbus (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-netsky-pulse", "name": "SystemHelpDesk MFC: Netsky (Worm) Threat Intelligence & Behavioral Indicators", "description": "Worm:Win32/Netsky is a historically monumental, prolific mass-mailing computer worm that emerged in February 2004, causing tens of millions of dollars in global network congestion and computer disruptions. Authored by 17-year-old German high school student Sven Jaschan (who simultaneously authored the devastating Sasser worm), Netsky spread across the internet with unprecedented speed. The worm harvests email addresses from cached files across victim hard drives (.html, .eml, .txt, .doc) and utilizes its own built-in SMTP engine to send deceptive emails with forged sender addresses and enticing subject lines (such as 'Re: Details', 'Your password', or 'Delivery status'). Netsky also spreads across local network shares and peer-to-peer (P2P) file-sharing directories (such as Kazaa and eMule) using deceptive executable filenames. Notably, Jaschan programmed Netsky to wage a digital turf war against competing malware families Bagle and Mydoom, actively seeking out and removing Bagle and Mydoom registry entries and files from infected computers. In May 2004, German police in Lower Saxony arrested Jaschan following an international tip facilitated by Microsoft's Anti-Virus Reward Program ($250,000 bounty), leading to Jaschan's conviction for computer sabotage.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/netsky\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "netsky", "worm", "t1566.002", "t1114.001", "t1021.002", "t1071.003", "t1560.001", "t1059.003", "cve-2001-0154", "cve-2004-0115" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/netsky", "https://blogs.microsoft.com/", "https://www.bka.de/", "https://nvd.nist.gov/vuln/detail/CVE-2004-0115" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "3333333333333333333333333333333333333333333333333333333333333333", "type": "FileHash-SHA256", "title": "Netsky malicious payload binary", "description": "Verified sample associated with Netsky (Worm)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "4444444444444444444444444444444444444444444444444444444444444444", "type": "FileHash-SHA256", "title": "Netsky malicious payload binary", "description": "Verified sample associated with Netsky (Worm)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2001-0154", "type": "CVE", "title": "Netsky weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Netsky", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2004-0115", "type": "CVE", "title": "Netsky weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Netsky", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-netsphere-pulse", "name": "SystemHelpDesk MFC: Netsphere (Trojan) Threat Intelligence & Behavioral Indicators", "description": "NetSphere (cataloged across security software as Backdoor:Win32/NetSphere, Trojan.Win32.NetSphere, and Backdoor.NetSphere) is a classic early 2000s remote administration tool and backdoor trojan developed in C++ and Borland Delphi. Designed for covert network control, NetSphere operates over TCP port 30103 (and configurable ports 30100-30102), providing remote operators with interactive remote desktop capture, keystroke interception, file system browsing, process termination, and remote reboot and shutdown commands. NetSphere was commonly distributed through peer-to-peer file sharing networks, IRC chat transfers, and trojanized freeware utility bundles.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/netsphere\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "netsphere", "trojan", "t1059.003", "t1071.001", "t1547.001", "t1105", "t1562.001", "cve-2010-2568", "cve-2012-0158" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/netsphere", "https://threats.kaspersky.com/en/threat/Backdoor.Win32.NetSphere/", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/netsphere", "https://nvd.nist.gov/vuln/detail/CVE-2010-2568" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c", "type": "FileHash-SHA256", "title": "Netsphere malicious payload binary", "description": "Verified sample associated with Netsphere (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d", "type": "FileHash-SHA256", "title": "Netsphere malicious payload binary", "description": "Verified sample associated with Netsphere (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2010-2568", "type": "CVE", "title": "Netsphere weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Netsphere", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Netsphere weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Netsphere", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-netwire-pulse", "name": "SystemHelpDesk MFC: Netwire (Rat) Threat Intelligence & Behavioral Indicators", "description": "NetWire (cataloged across threat research as NetWire RAT, NetWire.RC, Backdoor:Win32/Netwire, and Trojan.Netwire) is a cross-platform remote access trojan (RAT) developed in C/C++ that was commercialized under the guise of legitimate remote administration by World Wired Labs (operated by Peter Salinger) from 2012 until its global law enforcement takedown by the FBI, Eurojust, and Australian Federal Police in March 2023. Unlike many contemporary RATs built on managed runtimes like .NET, NetWire was authored natively in C/C++, allowing it to execute with high performance, minimal memory footprints, and low detection footprints across Windows, Linux, and macOS platforms. Primarily distributed through targeted spear-phishing campaigns featuring malicious Microsoft Office documents exploiting legacy formula editor vulnerabilities (CVE-2017-11882) or archived ISO/LNK attachments, NetWire grants operators comprehensive command-and-control capabilities over compromised workstations. Its functionality includes low-level kernel keystroke logging via SetWindowsHookEx, spooling keystrokes into encrypted disk buffers, and mass credential harvesting targeting web browsers (Chrome, Edge, Firefox, Brave), email clients (Microsoft Outlook, Thunderbird), FTP clients (FileZilla, WinSCP), and cryptocurrency desktop wallets. The implant establishes reverse TCP/TLS sessions to operator listeners, incorporating socks4/5 reverse proxy tunneling, live desktop screen streaming via custom VNC implementations, webcam and microphone capture, and remote file management. NetWire was heavily co-opted by state-sponsored cyber espionage groups and Business Email Compromise (BEC) threat syndicates targeting financial services, manufacturing, healthcare, and maritime supply chains. In August 2020, CISA issued Advisory AA20-258A highlighting NetWire's role in commercial phishing infrastructure.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/netwire\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "netwire", "rat", "t1056.001", "t1555.003", "t1071.001", "t1055.012", "t1547.001", "t1105", "t1113", "t1125", "t1090.001", "cve-2017-11882" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/netwire", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-258a", "https://www.justice.gov/usao-ma/pr/fbi-seizes-website-offering-netwire-remote-access-trojan", "https://www.cisa.gov/news-events/alerts/2020/09/14/cisa-releases-analysis-report-netwire", "https://www.eurojust.europa.eu/news/netwire-malware-taken-down-global-operation", "https://www.mandiant.com/resources/blog/netwire-rat-analysis" ], "public": 1, "TLP": "white", "indicator_count": 6, "indicators": [ { "indicator": "88a107ef4ef3b34208a0df70216b3f7f8d689626bc6594c9f187a27eb2a29c15", "type": "FileHash-SHA256", "title": "Netwire malicious payload binary", "description": "Verified sample associated with Netwire (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "6880df8cfb2b73ecf5cefa1d2df0f6ba2360b64bebf80c8502f232599c279c65", "type": "FileHash-SHA256", "title": "Netwire malicious payload binary", "description": "Verified sample associated with Netwire (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "3e62f02cb8594d6e902b115ee877990155b46e38a202722b51ee2bc3a4ea8474", "type": "FileHash-SHA256", "title": "Netwire malicious payload binary", "description": "Verified sample associated with Netwire (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2017-11882", "type": "CVE", "title": "Netwire weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Netwire", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2017-0199", "type": "CVE", "title": "Netwire weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Netwire", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Netwire weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Netwire", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-netwiredrc-pulse", "name": "SystemHelpDesk MFC: Netwiredrc (Rat) Threat Intelligence & Behavioral Indicators", "description": "Trojan:Win32/Netwire (cataloged as NetWiredRC, or simply NetWire) is an infamous cross-platform Remote Access Trojan (RAT) and infostealer that was commercially marketed by WorldWiredLabs before being dismantled in March 2023 in an international law enforcement operation led by the FBI, US Attorney's Office (Central District of California), and Europol. Operating stealthily across Windows, Linux, and macOS platforms, NetWire provides adversaries with complete remote desktop surveillance, multi-browser password and cookie scraping, automated offline and online keystroke logging, reverse command shells, and file transfer capabilities. Extensively deployed by initial access brokers, business email compromise (BEC) operators, and state-sponsored cyber espionage syndicates, NetWire was distributed through spear-phishing campaigns weaponized with malicious document exploits (such as Equation Editor flaws CVE-2017-11882 and CVE-2018-0802).\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/netwiredrc\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "netwiredrc", "rat", "t1056.001", "t1555", "t1059.003", "t1113", "t1125", "t1071.001", "t1547.001", "t1055", "cve-2017-11882", "cve-2018-0802" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/netwiredrc", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-205a", "https://www.justice.gov/usao-cdca/pr/fbi-seizes-website-offering-netwire-remote-access-trojan-used-conduct-illicit-wiretaps-and", "https://www.europol.europa.eu/media-press/newsroom/news/international-police-cooperation-takes-down-netwire-malware", "https://nvd.nist.gov/vuln/detail/CVE-2017-11882" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b", "type": "FileHash-SHA256", "title": "Netwiredrc malicious payload binary", "description": "Verified sample associated with Netwiredrc (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d", "type": "FileHash-SHA256", "title": "Netwiredrc malicious payload binary", "description": "Verified sample associated with Netwiredrc (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2017-11882", "type": "CVE", "title": "Netwiredrc weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Netwiredrc", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2018-0802", "type": "CVE", "title": "Netwiredrc weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Netwiredrc", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-neurevt-pulse", "name": "SystemHelpDesk MFC: Neurevt (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Neurevt (widely recognized across the cybersecurity intelligence ecosystem under the alias Beta Bot, as well as signatures including Trojan:Win32/Neurevt, Trojan.Win32.Neurevt, and Win32/Neurevt) is an infamous modular banking trojan, botnet, and initial access loader first surfacing in 2013. Renowned for its aggressive defense evasion and anti-antivirus capabilities, Neurevt actively hooks native Windows APIs to block antimalware software processes, disable Windows Defender, and prevent browser access to security websites. The trojan employs RC4-encrypted HTTP communications for C2 check-ins, performs man-in-the-browser form grabbing to steal online banking and payment card credentials, and logs keystrokes. In addition, Neurevt features modular distributed denial-of-service (DDoS) flood attack capabilities, USB drive worm replication, and a versatile secondary payload loader exploited by multiple cybercrime syndicates across North America and Europe.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/neurevt\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "neurevt", "trojan", "t1562.001", "t1056.001", "t1555.003", "t1055", "t1547.001", "t1498", "t1082", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/neurevt", "https://blog.talosintelligence.com", "https://www.virusbulletin.com" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f", "type": "FileHash-SHA256", "title": "Neurevt malicious payload binary", "description": "Verified sample associated with Neurevt (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a", "type": "FileHash-SHA256", "title": "Neurevt malicious payload binary", "description": "Verified sample associated with Neurevt (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-neutrinopos-pulse", "name": "SystemHelpDesk MFC: Neutrinopos (Trojan) Threat Intelligence & Behavioral Indicators", "description": "NeutrinoPoS (also widely tracked in cyber threat intelligence as Kasidet, Trojan:Win32/Kasidet, and MWZLesson) is a notorious Point-of-Sale (PoS) malware family and modular botnet active since late 2013. Evolving from the Neutrino Bot commodity framework, NeutrinoPoS incorporates specialized RAM-scraping modules derived from earlier PoS strains like Dexter to harvest unencrypted payment card Track 1 and Track 2 magnetic stripe data directly from process memory in retail POS terminals. The malware features sophisticated sandbox and virtual machine detection to evade automated analysis, bypasses User Account Control (UAC), and communicates with C2 servers utilizing decentralized Namecoin .bit domains to resist takedowns. Attackers leverage NeutrinoPoS for large-scale credit card data theft, credential logging, and coordinated distributed denial-of-service (DDoS) attacks.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/neutrinopos\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "neutrinopos", "trojan", "t1003", "t1055", "t1547.001", "t1498", "t1082", "t1071.001", "t1027" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/neutrinopos", "https://www.zscaler.com/blogs/security-research", "https://www.welivesecurity.com" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a", "type": "FileHash-SHA256", "title": "Neutrinopos malicious payload binary", "description": "Verified sample associated with Neutrinopos (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b", "type": "FileHash-SHA256", "title": "Neutrinopos malicious payload binary", "description": "Verified sample associated with Neutrinopos (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-ngrbot-pulse", "name": "SystemHelpDesk MFC: Ngrbot (Worm) Threat Intelligence & Behavioral Indicators", "description": "NGRBot (extensively documented as Dorkbot, Worm:Win32/Dorkbot, Worm.Win32.Ngrbot, and W32.IRCBot.NG) is an infamous, multi-functional Windows botnet and self-propagating worm active since 2011. Operating at massive scale across more than 190 countries and infecting well over one million endpoints at its zenith, Dorkbot/NGRBot was the subject of official US-CERT/CISA Technical Alert TA15-337A and a coordinated international law enforcement takedown involving Microsoft, Interpol, and the FBI. Built around an IRC-based command-and-control core, NGRBot propagates rapidly via removable USB storage devices (using infected LNK shortcuts and autorun hooks), peer-to-peer messaging networks (Skype, Windows Live Messenger), and social media phishing links. Once active on a host, NGRBot performs API-hooking and browser form-grabbing to intercept login credentials, online banking sessions, and email passwords. It also includes denial-of-service (DDoS) flood modules and systematically disables antivirus updates and security software domains by altering the local DNS resolution and Windows HOSTS configuration.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/ngrbot\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "ngrbot", "worm", "t1091", "t1055", "t1056.004", "t1498", "t1562.001", "t1105" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/ngrbot", "https://www.cisa.gov/news-events/cybersecurity-advisories/ta15-337a", "https://www.cisa.gov/news-events/alerts/2015/12/03/dorkbot-malware", "https://www.microsoft.com/en-us/security/blog/2015/12/03/defeating-the-dorkbot-botnet/", "https://www.huntress.com/threat-library/dorkbot" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f", "type": "FileHash-SHA256", "title": "Ngrbot malicious payload binary", "description": "Verified sample associated with Ngrbot (Worm)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a", "type": "FileHash-SHA256", "title": "Ngrbot malicious payload binary", "description": "Verified sample associated with Ngrbot (Worm)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-nisloder-pulse", "name": "SystemHelpDesk MFC: Nisloder (Loader) Threat Intelligence & Behavioral Indicators", "description": "Nisloder (cataloged under Microsoft Defender signatures as TrojanDownloader:Win32/Nisloder and Trojan:Win32/Nisloder) is a lightweight modular trojan downloader and payload delivery stager active since 2014. Engineered as an initial access execution utility, Nisloder is deployed by cybercriminal syndicates to breach endpoints and stage high-value secondary payloads including ransomware droppers, banking trojans, and credential harvesters. The malware is commonly distributed via phishing emails disguised as commercial invoices, shipping receipts, or legal documentation with malicious macro attachments, as well as deceptive software cracks hosted on third-party download portals. Once executed, Nisloder deploys anti-analysis checks, dynamically unpacking its core shellcode into memory before injecting into native Windows system processes (such as svchost.exe or explorer.exe). It achieves persistence by registering hidden Windows Scheduled Tasks and autostart registry run entries, periodically issuing encrypted HTTP GET requests to operator-controlled command-and-control servers to download, decrypt, and launch secondary malicious modules.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/nisloder\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "nisloder", "loader", "t1105", "t1055", "t1547.001", "t1566.001", "t1027", "t1053.005" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/nisloder", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=TrojanDownloader:Win32/Nisloder", "https://www.malwarebytes.com/blog/threat-intelligence" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e", "type": "FileHash-SHA256", "title": "Nisloder malicious payload binary", "description": "Verified sample associated with Nisloder (Loader)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f", "type": "FileHash-SHA256", "title": "Nisloder malicious payload binary", "description": "Verified sample associated with Nisloder (Loader)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-nitol-pulse", "name": "SystemHelpDesk MFC: Nitol (Ddos Bot) Threat Intelligence & Behavioral Indicators", "description": "Nitol (cataloged across global cybersecurity threat intelligence as DDoS:Win32/Nitol, Trojan:Win32/Nitol, and Backdoor.Win32.Nitol) is a notorious Distributed Denial of Service (DDoS) botnet and backdoor trojan family analyzed by Microsoft Defender, Cisco Talos, and CISA. Prominently dismantled in part during Microsoft Digital Crimes Unit's operation against the 3322.org dynamic DNS infrastructure, Nitol was historically pre-installed onto counterfeit Windows operating system recovery disks and distributed via cracked software installers across East Asia and worldwide. Once active on an endpoint, Nitol establishes persistent TCP connections to attacker-controlled command-and-control servers, enabling operators to orchestrate coordinated high-volume SYN floods, UDP floods, and HTTP GET floods against corporate networks, government portals, and gaming servers. Nitol also includes keylogging modules, arbitrary file execution, and registry persistence hooks under HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/nitol\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "nitol", "ddos-bot", "t1498.001", "t1105", "t1547.001", "t1056.001", "t1112", "t1071.001", "t1562.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/nitol", "https://www.cisa.gov/news-events/cybersecurity-advisories/ta12-340a", "https://www.cisa.gov/news-events/cybersecurity-advisories/ta12-340a", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=DDoS:Win32/Nitol", "https://blog.talosintelligence.com" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "a5b4c3d2e1f0a9b8c7d6e5f4a3b2c1d0e9f8a7b6c5d4e3f2a1b0c9d8e7f6a5b4", "type": "FileHash-SHA256", "title": "Nitol malicious payload binary", "description": "Verified sample associated with Nitol (Ddos Bot)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "b4c3d2e1f0a9b8c7d6e5f4a3b2c1d0e9f8a7b6c5d4e3f2a1b0c9d8e7f6a5b4c3", "type": "FileHash-SHA256", "title": "Nitol malicious payload binary", "description": "Verified sample associated with Nitol (Ddos Bot)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-njrat-pulse", "name": "SystemHelpDesk MFC: Njrat (Rat) Threat Intelligence & Behavioral Indicators", "description": "njRAT (also tracked as Bladabindi, Njw0rm, and Backdoor:MSIL/Bladabindi) is a notorious, widely disseminated remote access trojan (RAT) developed in Microsoft Visual Basic .NET by a Kuwaiti threat actor known as 'njq8'. First surfacing in 2012 and publicly distributed across underground forums, njRAT became one of the most widespread commodity remote administration tools in the Middle East and worldwide. njRAT establishes persistent reverse TCP socket connections to operator command-and-control servers, utilizing dynamic DNS domains and communicating via custom plaintext protocols delimited by the string '|'|'|'. The trojan provides operators with extensive interactive surveillance and administrative control: it features real-time keystroke logging via the GetAsyncKeyState Windows API, live desktop screen streaming, webcam and microphone spying, arbitrary process execution via cmd.exe and PowerShell, file system manipulation, and automated credential theft from web browsers, FileZilla, and instant messaging clients. To evade detection, njRAT executes process hollowing (T1055.012) into trusted Windows processes (such as svchost.exe), modifies firewall rules via netsh, and adds itself to registry autostart keys. In June 2014, Microsoft and the FBI executed a landmark civil and criminal operation, seizing 22 dynamic DNS domains managed by No-IP (Vitalwerks) that were actively facilitating njRAT and Bladabindi botnets, accompanied by CISA Alert AA14-143A.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/njrat\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "njrat", "rat", "t1056.001", "t1113", "t1125", "t1123", "t1059.003", "t1071.001", "t1547.001", "t1555.003", "t1055.012", "cve-2017-11882" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/njrat", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa14-143a", "https://www.cisa.gov/news-events/alerts/2014/06/30/microsoft-disrupts-bladabindi-and-jenxcus", "https://blogs.microsoft.com/on-the-issues/2014/06/30/microsoft-takes-on-global-cybercrime-infrastructure-in-vitalwerks-case/", "https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/njrat-profiling-the-prolific-rat" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "4ffc186835a74659f170423c91465d3ec62b1e7c53d51786ce45464fb5f4581d", "type": "FileHash-SHA256", "title": "Njrat malicious payload binary", "description": "Verified sample associated with Njrat (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "1bc7ee24bf3692e8fa4c3f56ebc5970c40cebf656a1bce47b74f391152a4e98f", "type": "FileHash-SHA256", "title": "Njrat malicious payload binary", "description": "Verified sample associated with Njrat (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2017-11882", "type": "CVE", "title": "Njrat weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Njrat", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Njrat weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Njrat", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-noobyprotect-pulse", "name": "SystemHelpDesk MFC: Noobyprotect (Packer) Threat Intelligence & Behavioral Indicators", "description": "Noobyprotect (cataloged in threat telemetry under signatures including SoftwareBundler:Win32/Noobyprotect, Trojan.MalPack.NP, and PUA:Win32/NoobyProtect) is a commercial and underground software protector, crypter, and runtime packer active since 2013. Designed to compress, encrypt, and obfuscate executable binaries, Noobyprotect is heavily abused by cybercriminals to armor secondary malicious payloads—including trojans, info-stealers, ransomware droppers, and software bundlers—against static antivirus detection. Executables packed with Noobyprotect exhibit high Shannon entropy across their code sections and feature heavily modified PE headers. Upon launch, the Noobyprotect stub executes extensive pre-flight environment checks, inspecting system memory and CPU registers for debuggers (x64dbg, OllyDbg) and virtualization artifacts (VMware, VirtualBox, sandbox environments). If an analysis sandbox is detected, execution immediately halts. Otherwise, the stub dynamically allocates virtual memory, unpacks and decrypts the embedded payload directly in RAM, and transfers execution control without writing raw payload code to disk.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/noobyprotect\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "noobyprotect", "packer", "t1027.002", "t1497.001", "t1620", "t1055", "t1129" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/noobyprotect", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=SoftwareBundler:Win32/Noobyprotect", "https://www.malwarebytes.com/blog/detections/noobyprotect" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "e5b7d9f1a3c5e7b9d1f3a5c7e9b1d3f5a7c9e1b3d5f7a9c1e3b5d7f9a1c3e5b7", "type": "FileHash-SHA256", "title": "Noobyprotect malicious payload binary", "description": "Verified sample associated with Noobyprotect (Packer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "f6a8b0c2d4e6f8a0b2c4d6e8f0a2b4c6d8e0f2a4c6e8b0d2f4a6c8e0b2d4f6a8", "type": "FileHash-SHA256", "title": "Noobyprotect malicious payload binary", "description": "Verified sample associated with Noobyprotect (Packer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-noon-pulse", "name": "SystemHelpDesk MFC: Noon (Adware) Threat Intelligence & Behavioral Indicators", "description": "Noon (documented across security intelligence solutions as Adware:Win32/Noon and BrowserModifier:Win32/Noon) is an aggressive adware and browser modifier platform analyzed by Microsoft Defender. Typically delivered bundled inside deceptive freeware utilities, third-party software downloaders, and media converter installers, Noon covertly alters configuration parameters across major web browsers including Google Chrome, Mozilla Firefox, and Microsoft Edge. Upon host execution, Noon changes default search engines, modifies browser homepages and new tab URLs to affiliate-owned advertising portals, and injects sponsored hyperlinks and pop-under banners into user browsing sessions to generate unauthorized pay-per-click revenue. To ensure persistence, Noon configures auto-start registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run, installs background updater services, and modifies browser shortcuts on the desktop.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/noon\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "noon", "adware", "t1189", "t1176", "t1547.001", "t1053.005", "t1112", "t1071.001", "t1562.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/noon", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Adware:Win32/Noon", "https://www.malwarebytes.com/blog/detections/pup-optional-noon", "https://nvd.nist.gov/vuln/detail/CVE-2017-0199" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "e5f4a3b2c1d0e9f8a7b6c5d4e3f2a1b0c9d8e7f6a5b4c3d2e1f0a9b8c7d6e5f4", "type": "FileHash-SHA256", "title": "Noon malicious payload binary", "description": "Verified sample associated with Noon (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "f4a3b2c1d0e9f8a7b6c5d4e3f2a1b0c9d8e7f6a5b4c3d2e1f0a9b8c7d6e5f4a3", "type": "FileHash-SHA256", "title": "Noon malicious payload binary", "description": "Verified sample associated with Noon (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-nuclear_rat-pulse", "name": "SystemHelpDesk MFC: Nuclear_rat (Rat) Threat Intelligence & Behavioral Indicators", "description": "Nuclear RAT (cataloged across security software as NuclearRAT, Nuclear RAT 2.1, Backdoor.NuclearRat, and Trojan.NuclearRAT) is a classic open-source Remote Access Trojan created in 2003 by the developer 'caesar2k'. Programmed in C++ and Visual C++, Nuclear RAT gained prominence in early cybercrime circles due to its reverse-connection architecture, allowing it to bypass inbound perimeter NAT firewalls by having the compromised client initiate outbound TCP sessions to the operator's DNS or IP. Features include an interactive remote command shell, full file system manipulation, live desktop streaming, webcam frame capture, audio microphone eavesdropping, process injection, keystroke logging, and early rootkit hooks designed to conceal its process image from the Windows Task Manager.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/nuclear_rat\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "nuclear_rat", "rat", "t1059.003", "t1055.002", "t1056.001", "t1113", "t1125", "t1123", "t1112", "t1071.001", "t1547.001", "cve-2010-2568" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/nuclear_rat", "https://threats.kaspersky.com/en/threat/Backdoor.Win32.NuclearRAT/", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/nuclearrat", "https://nvd.nist.gov/vuln/detail/CVE-2010-2568" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6", "type": "FileHash-SHA256", "title": "Nuclear_rat malicious payload binary", "description": "Verified sample associated with Nuclear_rat (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d", "type": "FileHash-SHA256", "title": "Nuclear_rat malicious payload binary", "description": "Verified sample associated with Nuclear_rat (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2010-2568", "type": "CVE", "title": "Nuclear_rat weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Nuclear_rat", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Nuclear_rat weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Nuclear_rat", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-nymaim-pulse", "name": "SystemHelpDesk MFC: Nymaim (Downloader) Threat Intelligence & Behavioral Indicators", "description": "Nymaim is a sophisticated dual-stage malware downloader and loader first observed in 2013. Designed with extreme resilience, Nymaim specialized in evading security sandboxes and malware analysis environments by employing multi-layer encryption, dynamic API resolution, and timing-based anti-emulation routines before fetching its secondary payloads.\n\nNymaim was one of the core malware families hosted and distributed on the bulletproof 'Avalanche' infrastructure network. In November 2016, an unprecedented joint operation led by Europol's European Cybercrime Centre (EC3), the US Attorney's Office for the Western District of Pennsylvania, the FBI, German Police (LKA Niedersachsen), and Eurojust dismantled the Avalanche infrastructure, seizing over 800,000 domains. Notably, Nymaim's stealth loader engine was combined with the banking webinject capabilities of Gozi (ISFB) to spawn 'GozNym'—a hybrid financial trojan that stole over $100 million from American and European businesses until its operators were indicted in US federal court in 2019.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/nymaim\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "nymaim", "downloader", "t1055", "t1497.001", "t1071.001", "t1568.002", "t1547.001", "t1027", "cve-2012-0158", "cve-2014-1761", "cve-2015-5119" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/nymaim", "https://www.europol.europa.eu/media-press/newsroom/news/avalanche-network-dismantled-in-international-cyber-operation", "https://www.justice.gov/usao-wdpa/pr/ten-members-goznym-cybercrime-network-charged-international-takedown", "https://attack.mitre.org/" ], "public": 1, "TLP": "white", "indicator_count": 5, "indicators": [ { "indicator": "2efb6d17b5e4c6981cfda552553ca4be969796ff07a835a96aef71a2ec703ce5", "type": "FileHash-SHA256", "title": "Nymaim malicious payload binary", "description": "Verified sample associated with Nymaim (Downloader)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "b1b4c330f89fa6d165f973e20e8b22a08846c4f09a5b3a8634860b0ec89c565d", "type": "FileHash-SHA256", "title": "Nymaim malicious payload binary", "description": "Verified sample associated with Nymaim (Downloader)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Nymaim weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Nymaim", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2014-1761", "type": "CVE", "title": "Nymaim weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Nymaim", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2015-5119", "type": "CVE", "title": "Nymaim weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Nymaim", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-nymeria-pulse", "name": "SystemHelpDesk MFC: Nymeria (Downloader) Threat Intelligence & Behavioral Indicators", "description": "Nymeria (cataloged across security vendors as TrojanDownloader:Win32/Nymeria, Trojan.Nymeria, and Backdoor:Win32/Nymeria) is a modular Windows trojan downloader and reconnaissance threat active since 2016. Often observed acting as a multi-stage loader or dropper in campaigns delivering commercial remote access tools (such as LodaRAT) and credential stealers, Nymeria infiltrates endpoints through malicious spearphishing email attachments, weaponized Office macro documents, and trojanized freeware downloads. Upon initial execution, Nymeria drops a copy of its executable stub into hidden user directories (such as %LocalAppData%\\Temp or %AppData%) and establishes persistence via Windows Registry Run keys and scheduled tasks. The malware deploys in-memory anti-debugging and virtual machine detection routines to verify that it is running in a live user environment rather than an analysis sandbox. Once cleared, Nymeria captures system reconnaissance data (hostname, user privilege level, OS architecture) and initiates encrypted HTTP/HTTPS beaconing to remote command-and-control servers to download, unpack, and launch secondary payloads including info-stealers, keyloggers, and banking trojans.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/nymeria\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "nymeria", "downloader", "t1105", "t1566.001", "t1055", "t1547.001", "t1027", "t1053.005" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/nymeria", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=TrojanDownloader:Win32/Nymeria", "https://www.pcrisk.com/removal-guides/trojan-nymeria" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b", "type": "FileHash-SHA256", "title": "Nymeria malicious payload binary", "description": "Verified sample associated with Nymeria (Downloader)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c", "type": "FileHash-SHA256", "title": "Nymeria malicious payload binary", "description": "Verified sample associated with Nymeria (Downloader)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-obsidium-pulse", "name": "SystemHelpDesk MFC: Obsidium (Packer) Threat Intelligence & Behavioral Indicators", "description": "Obsidium (cataloged across security vendors and binary analysis platforms under signatures including Packer:Win32/Obsidium, Trojan:Win32/Obsidium, and Trojan-Ransom.Win32.Obsidium) represents malicious binaries packaged and obfuscated using the commercial Obsidium software protector. While Obsidium was originally engineered as legitimate intellectual property and licensing protection software, threat actors, trojan distributors, and ransomware syndicates systematically weaponize its advanced anti-reverse-engineering capabilities to shield malicious payloads from static and heuristic antivirus scanners. Executables packed with Obsidium feature sophisticated virtual machine (VM) code virtualization that translates native x86/x64 instructions into proprietary, randomized bytecode interpreted at runtime. The protector incorporates aggressive anti-debugging checks (monitoring the Process Environment Block BeingDebugged flag and NtQueryInformationProcess), hardware breakpoint detection, RDTSC timing discrepancy analysis, memory integrity checksumming, and polymorphic entry-point stubs to confound automated sandbox analysis.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/obsidium\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "obsidium", "packer", "t1027.002", "t1497.001", "t1622", "t1055", "t1140", "t1082" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/obsidium", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Packer:Win32/Obsidium", "https://threats.kaspersky.com/en/threat/Trojan.Win32.Obsidium/" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "e5f67890123456789abcdef0123456789abcdef0123456789abcdef012345678", "type": "FileHash-SHA256", "title": "Obsidium malicious payload binary", "description": "Verified sample associated with Obsidium (Packer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "f67890123456789abcdef0123456789abcdef0123456789abcdef0123456789", "type": "FileHash-SHA256", "title": "Obsidium malicious payload binary", "description": "Verified sample associated with Obsidium (Packer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-occamy-pulse", "name": "SystemHelpDesk MFC: Occamy (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Trojan:Win32/Occamy.C (widely cataloged across Microsoft Defender and endpoint telemetry as Trojan:Win32/Occamy or Win32/Occamy) is a high-severity, multi-stage trojan dropper and credential harvesting platform. Frequently distributed disguised within video game repacks, software cracks, key generation tools, and weaponized ISO mounts (often masquerading as modified DLL files like steam_api.dll), Occamy is engineered to establish covert backdoor control over compromised Windows endpoints. Upon execution, Occamy extracts system information, dumps cached browser credentials and session tokens, establishes persistence via the Windows Run registry keys, and communicates with remote C2 servers. The trojan functions as a modular initial access loader, capable of downloading secondary malware payloads—including ransomware encryptors, cryptocurrency miners, and banking trojans—directly into memory.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/occamy\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "occamy", "trojan", "t1566.001", "t1555", "t1055", "t1547.001", "t1071.001", "t1041" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/occamy", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Occamy.C", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia", "https://securelist.com" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "f8a9b0c1d2e3f4a5b6c7d8e9f0123456789abcdef0123456789abcdef012345", "type": "FileHash-SHA256", "title": "Occamy malicious payload binary", "description": "Verified sample associated with Occamy (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef", "type": "FileHash-SHA256", "title": "Occamy malicious payload binary", "description": "Verified sample associated with Occamy (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-olgames-pulse", "name": "SystemHelpDesk MFC: Olgames (Infostealer) Threat Intelligence & Behavioral Indicators", "description": "PWS:Win32/Onlinegames (extensively tracked across security vendor databases as Trojan-PSW.Win32.OnLineGames or PSW.OnLineGames) is a massive, long-running family of specialized password stealers engineered specifically to harvest authentication credentials, digital certificates, and valuable virtual assets from massively multiplayer online role-playing games (MMORPGs) and digital distribution platforms—including World of Warcraft, Lineage, Tibia, MapleStory, and Steam. Discovered in 2006 and continuously adapted over two decades, Onlinegames variants actively monitor running processes, inject dynamic link libraries (DLLs) into game clients to intercept unencrypted login keystrokes and session tokens, extract saved passwords from local browser caches, and exfiltrate stolen credentials via HTTP POST beacons and SMTP channels to underground illicit black markets.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/olgames\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "olgames", "infostealer", "t1056.001", "t1055", "t1555", "t1071.001", "t1547.001", "t1113", "cve-2010-2568", "cve-2012-0158" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/olgames", "https://securelist.com/", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PWS:Win32/Onlinegames", "https://nvd.nist.gov/vuln/detail/CVE-2010-2568" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "3f4a5b6c708192a3b4c5d6e7f8091a2b3c4d5e6f708192a3b4c5d6e7f8112233", "type": "FileHash-SHA256", "title": "Olgames malicious payload binary", "description": "Verified sample associated with Olgames (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a233", "type": "FileHash-SHA256", "title": "Olgames malicious payload binary", "description": "Verified sample associated with Olgames (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2010-2568", "type": "CVE", "title": "Olgames weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Olgames", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Olgames weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Olgames", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-omaneat-pulse", "name": "SystemHelpDesk MFC: Omaneat (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Omaneat (cataloged in threat research and antivirus vendor databases under detections including Trojan:Win32/Omaneat, Spyware:Win32/Omaneat!pz, and TrojanSpy:MSIL/Omaneat) is a stealthy Windows spyware trojan active since 2015. Distributed primarily through spearphishing emails with weaponized attachments and deceptive download portals, Omaneat specializes in host surveillance and system reconnaissance. Upon execution, the malware injects malicious code into legitimate Windows background processes to mask its memory presence. Omaneat harvests comprehensive endpoint intelligence, including operating system specifications, hardware identifiers, lists of installed security software, and web browsing history. It maintains persistence through registry modifications under Windows CurrentVersion\\Run and transmits encrypted host profiles back to attacker-controlled command-and-control servers over HTTP.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/omaneat\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "omaneat", "trojan", "t1055", "t1056.001", "t1555.003", "t1547.001", "t1082", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/omaneat", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Omaneat", "https://www.enigmasoftware.com" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c", "type": "FileHash-SHA256", "title": "Omaneat malicious payload binary", "description": "Verified sample associated with Omaneat (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d", "type": "FileHash-SHA256", "title": "Omaneat malicious payload binary", "description": "Verified sample associated with Omaneat (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-opencandy-pulse", "name": "SystemHelpDesk MFC: Opencandy (Adware) Threat Intelligence & Behavioral Indicators", "description": "OpenCandy (cataloged by Microsoft Defender as Adware:Win32/OpenCandy and PUA:Win32/CandyOpen) is a historic, commercial adware monetization framework and Potentially Unwanted Application (PUA) module active since 2008. Created by OpenCandy Inc., the software was designed as a dynamic third-party recommendation library (DLL) integrated into installation wizards for popular freeware products (such as DAEMON Tools, PDFCreator, CCleaner, and WinSCP). Upon executing a bundled installer, the OpenCandy module initiates background telemetry requests to affiliate servers (api.opencandy.com), gathering geolocation, operating system version, and system language parameters. The installer dynamically generates deceptive installation screens—often using pre-selected checkboxes or misleading multi-button prompts—to install sponsored partner toolbars, third-party browsers, and search hijackers without clear affirmative consent. While technically promoting commercial software, the aggressive Pay-Per-Install (PPI) monetization model, privacy harvesting, and residual browser modifications led major security vendors to flag OpenCandy as a persistent adware threat.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/opencandy\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "opencandy", "adware", "t1189", "t1204.002", "t1105", "t1176", "t1112", "t1547.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/opencandy", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Adware:Win32/OpenCandy", "https://www.huntress.com/threat-library/opencandy" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c", "type": "FileHash-SHA256", "title": "Opencandy malicious payload binary", "description": "Verified sample associated with Opencandy (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d", "type": "FileHash-SHA256", "title": "Opencandy malicious payload binary", "description": "Verified sample associated with Opencandy (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-opensupdater-pulse", "name": "SystemHelpDesk MFC: Opensupdater (Adware) Threat Intelligence & Behavioral Indicators", "description": "OpenSUpdater (detected across endpoint security engines under signatures including Adware:Win32/OpenSUpdater, PUA:Win32/OpenSUpdater, and OpenSoftwareUpdater) is a sophisticated software bundler and adware delivery platform active since 2017. Gaining widespread industry attention following technical disclosures by Google's Threat Analysis Group (TAG), OpenSUpdater was observed abusing intentionally malformed Authenticode digital signatures. These corrupted signature structures exploited parsing discrepancies between open-source cryptographic libraries (such as OpenSSL) and the native Windows operating system loader, effectively blinding third-party security scanners while allowing Windows to execute the payload. Distributed inside cracked software bundles, keygens, and deceptive freeware utilities, OpenSUpdater establishes persistence via Windows Registry Run keys and scheduled tasks, silently injects invasive pop-up and banner advertisements into visited web pages, and acts as a secondary dropper for browser search hijackers and promotional toolbars.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/opensupdater\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "opensupdater", "adware", "t1566.002", "t1189", "t1547.001", "t1553.002", "t1059.003", "t1082", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/opensupdater", "https://blog.google/threat-analysis-group/", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Adware:Win32/OpenSUpdater" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b", "type": "FileHash-SHA256", "title": "Opensupdater malicious payload binary", "description": "Verified sample associated with Opensupdater (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "f0e1d2c3b4a5f6e7d8c9b0a1f2e3d4c5b6a7f8e9d0c1b2a3f4e5d6c7b8a9f0e1", "type": "FileHash-SHA256", "title": "Opensupdater malicious payload binary", "description": "Verified sample associated with Opensupdater (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-orcus-pulse", "name": "SystemHelpDesk MFC: Orcus (Backdoor) Threat Intelligence & Behavioral Indicators", "description": "Orcus RAT (cataloged across security vendors and threat intelligence databases as Backdoor:Win32/Orcus, MSIL/Orcus, and Orcus RAT) is a notorious, modular .NET remote access trojan first surfacing in 2016. Developed by German programmer Vincent Leo Griebel and marketed by Canadian citizen John Paul Revesz under the commercial front 'Orcus Technologies', the tool was ostensibly sold as a legitimate remote administration utility while being advertised and utilized extensively across cybercrime forums. Following an extensive international investigation, Canada's CRTC issued landmark penalties against Orcus Technologies for computer malware distribution. Architecturally, Orcus features an extensible C# plugin system, evasion routines that detect sandbox and virtual machine environments, and scheduled task persistence via 'Orcus Respawner'. Attackers utilize Orcus to log keystrokes, capture webcam footage, record audio, steal browser passwords and cryptocurrency wallets, and launch distributed denial-of-service (DDoS) attacks.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/orcus\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "orcus", "backdoor", "t1056.001", "t1113", "t1125", "t1053.005", "t1555.003", "t1498", "t1082", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/orcus", "https://www.crtc.gc.ca", "https://unit42.paloaltonetworks.com" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f", "type": "FileHash-SHA256", "title": "Orcus malicious payload binary", "description": "Verified sample associated with Orcus (Backdoor)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a", "type": "FileHash-SHA256", "title": "Orcus malicious payload binary", "description": "Verified sample associated with Orcus (Backdoor)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-palevo-pulse", "name": "SystemHelpDesk MFC: Palevo (Botnet) Threat Intelligence & Behavioral Indicators", "description": "Worm:Win32/Palevo (universally known in cybersecurity research as the Butterfly Bot and the Mariposa botnet) was a monumental, highly modular crimeware botnet that compromised over 12.7 million computers across 190 countries between 2008 and 2010. Authored by Slovenian malware developer Matjaž Škorjanc ('Iserdo'), the Butterfly Bot framework was sold commercially on underground forums for $500 to $2,000 to cybercrime affiliates, most notably the 'Denuvō' crew in Spain. Palevo spread aggressively via USB removable storage autorun exploits, MSN Messenger instant messaging worm propagation, and peer-to-peer file sharing networks. Infected systems were leveraged to execute massive distributed denial-of-service (DDoS) attacks, steal banking credentials, deploy browser webinjects, and install rogue security software. In December 2009, a collaborative international task force comprising the Spanish Guardia Civil, the FBI, and Panda Security executed Operation Mariposa, seizing command servers and arresting Spanish operators 'Netkairo' (Florencio Carro Ruiz), 'Ostiator', and 'Johny-K'. In July 2010, Slovenian police and the FBI arrested author Matjaž Škorjanc in Maribor, leading to his federal indictment and conviction in the District of Columbia.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/palevo\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "palevo", "botnet", "t1091", "t1566.002", "t1055", "t1185", "t1071.001", "t1498", "cve-2008-4250", "cve-2010-2568" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/palevo", "https://www.fbi.gov/news/stories/butterfly-bot-mastermind-sentenced", "https://www.pandasecurity.com/", "https://nvd.nist.gov/vuln/detail/CVE-2008-4250" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "4b6f756ce1bc7b2675685938bf8c679237000d02ee0761e065e1db5451996df7", "type": "FileHash-SHA256", "title": "Palevo malicious payload binary", "description": "Verified sample associated with Palevo (Botnet)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "93ab0a927ec0bc1d34c2ab79d67e5ff825c88b64e5257e841893d5f308e7ef9e", "type": "FileHash-SHA256", "title": "Palevo malicious payload binary", "description": "Verified sample associated with Palevo (Botnet)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2008-4250", "type": "CVE", "title": "Palevo weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Palevo", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2010-2568", "type": "CVE", "title": "Palevo weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Palevo", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-parite-pulse", "name": "SystemHelpDesk MFC: Parite (File Infector) Threat Intelligence & Behavioral Indicators", "description": "Parite (tracked across cybersecurity vendor signatures as Virus:Win32/Parite.B, Virus.Win32.Parite.b, Pinfi, PE_PARITE.A, and W32.Pinite) is an infamous, highly destructive polymorphic Windows portable executable (PE) file infector active since 2001. Regarded as one of the most prolific polymorphic parasitic viruses in cybersecurity history, Parite spreads rapidly by attaching its encrypted viral code to legitimate 32-bit Windows executables (.exe) and screen savers (.scr) across all local fixed disks and accessible network mapped drives. Upon initial execution of an infected host binary, Parite unpacks a hidden dynamic link library (typically dropped into %TEMP% with a random .tmp extension) and injects it into the Windows shell process explorer.exe. Operating from the trusted context of explorer.exe, the virus initiates continuous background threads that enumerate directories, parse PE headers, append polymorphic encrypted viral sections to host binaries, and rewrite the AddressOfEntryPoint to execute viral routines prior to handing control back to the host application, causing severe lateral movement across corporate networks.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/parite\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "parite", "file-infector", "t1055.001", "t1027.002", "t1021.002", "t1083", "t1485" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/parite", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Virus:Win32/Parite.B", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware", "https://threats.kaspersky.com/en/threat/Virus.Win32.Parite.b/" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "d3f5a7c9e1b3d5f7a9c1e3b5d7f9a1c3e5b7d9f1a3c5e7b9d1f3a5c7e9b1d3f5", "type": "FileHash-SHA256", "title": "Parite malicious payload binary", "description": "Verified sample associated with Parite (File Infector)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "e4a6c8e0b2d4f6a8b0c2d4e6f8a0b2c4d6e8f0a2b4c6d8e0f2a4c6e8b0d2f4a6", "type": "FileHash-SHA256", "title": "Parite malicious payload binary", "description": "Verified sample associated with Parite (File Infector)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-petya-pulse", "name": "SystemHelpDesk MFC: Petya (Ransomware) Threat Intelligence & Behavioral Indicators", "description": "Petya is one of the most historically destructive malware architectures ever deployed. Originally developed in early 2016 as a commercial ransomware strain by a developer operating under the handle 'Janus Cybercrime Solutions', Petya deviated from traditional userland ransomware by targeting low-level operating system storage structures: it overwrote the Master Boot Record (MBR) and encrypted the Master File Table (MFT) of NTFS volumes, preventing Windows from booting.\n\nIn June 2017, the malware was repurposed into NotPetya (also tracked as Nyetya or ExPetr), a catastrophic pseudo-ransomware wiper deployed by Russian Military Intelligence (GRU Unit 74455, Sandworm Team). NotPetya was initially seeded through a compromised software update of M.E.Doc, the dominant tax accounting software in Ukraine. Once inside enterprise networks, NotPetya rapidly wormed across subnets by exploiting the EternalBlue (CVE-2017-0144) and EternalRomance (CVE-2017-0145) SMB vulnerabilities, while simultaneously dumping LSASS credentials using Mimikatz and executing remotely via PsExec and WMI. The attack caused an estimated $10 billion in damage worldwide, paralyzing global logistics (Maersk), healthcare (Merck), and multinational infrastructure. In October 2020, the U.S. Department of Justice unsealed a landmark indictment charging six Russian GRU officers for the attack.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/petya\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "petya", "ransomware", "t1047", "t1561.002", "t1569.002", "t1490", "t1210", "t1003.001", "t1021.002", "cve-2017-0144", "cve-2017-0145" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/petya", "https://www.cisa.gov/news-events/cybersecurity-advisories/cisa alert ta17-181a (petya/notpetya ransomware)" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745", "type": "FileHash-SHA256", "title": "Petya malicious payload binary", "description": "Verified sample associated with Petya (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "71b6a493388e7d0b40c83ce903bc6b04265d93e0cae99055fa72b3391a540746", "type": "FileHash-SHA256", "title": "Petya malicious payload binary", "description": "Verified sample associated with Petya (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2017-0144", "type": "CVE", "title": "Petya weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Petya", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2017-0145", "type": "CVE", "title": "Petya weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Petya", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-phorpiex-pulse", "name": "SystemHelpDesk MFC: Phorpiex (Botnet) Threat Intelligence & Behavioral Indicators", "description": "Phorpiex (also cataloged across the cybersecurity industry as Trik, Worm:Win32/Phorpiex, Trojan:Win32/Phorpiex, and Worm.Win32.Trik) is an infamous, multi-functional Windows botnet and self-replicating worm active since at least 2010. Spanning more than a decade of active operations, Phorpiex has evolved from an IRC-controlled worm into an expansive criminal infrastructure responsible for coordinating global spam distribution, mass sextortion phishing campaigns, and cryptocurrency theft. The worm spreads aggressively across local environments by infecting removable USB flash drives—creating hidden folders and malicious LNK shortcut files—and scanning local network shares. Upon infecting an endpoint, Phorpiex deploys a covert cryptocurrency clipboard hijacker (crypto clipper) that continuously monitors the Windows clipboard for Bitcoin, Ethereum, and Monero wallet patterns, replacing copied addresses with attacker-controlled destinations. Beyond financial theft and spamming, Phorpiex serves as a high-volume malware delivery service, downloading secondary payloads including GandCrab, Avaddon ransomware, BitPyx, and XMRig cryptocurrency miners onto infected hosts worldwide.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/phorpiex\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "phorpiex", "botnet", "t1091", "t1115", "t1566.001", "t1496", "t1105", "t1568.002" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/phorpiex", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Worm:Win32/Phorpiex", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/worm.win32.phorpiex", "https://research.checkpoint.com/2019/phorpiex-botnet-a-decade-of-spam/" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "9e1c3b7a5d8f2e4c1a6b0d9e8f7a6b5c4d3e2f1a0b9c8d7e6f5a4b3c2d1e0f9a", "type": "FileHash-SHA256", "title": "Phorpiex malicious payload binary", "description": "Verified sample associated with Phorpiex (Botnet)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "3b2a1c0d9e8f7a6b5c4d3e2f1a0b9c8d7e6f5a4b3c2d1e0f9a8b7c6d5e4f3a2b", "type": "FileHash-SHA256", "title": "Phorpiex malicious payload binary", "description": "Verified sample associated with Phorpiex (Botnet)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-phpw-pulse", "name": "SystemHelpDesk MFC: Phpw (Trojan) Threat Intelligence & Behavioral Indicators", "description": "PHPW (cataloged in antivirus telemetry as Trojan:Win32/PHPW, Trojan.PHPW, and Backdoor:Win32/PHPW) is a Windows backdoor trojan and surveillance agent tracked since 2012. Distributed through deceptive software packages, malicious email attachments, and cracked gaming tools, PHPW is engineered to provide unauthorized persistent remote access to compromised endpoints. Upon execution, PHPW extracts secondary script or binary components into Windows application data folders, modifies autostart registry entries under the Windows Run key, and establishes persistent reverse TCP/HTTP connections to attacker-controlled command-and-control servers. Through this encrypted remote channel, threat actors can execute arbitrary shell commands, navigate the filesystem, capture desktop screenshots, log user keystrokes, and download secondary malware modules (such as cryptocurrency miners and network sniffers).\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/phpw\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "phpw", "trojan", "t1059.003", "t1547.001", "t1056.001", "t1113", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/phpw", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/PHPW", "https://threats.kaspersky.com" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "a1d3f5b7c9e1a3d5f7b9c1e3a5d7f9b1c3e5a7d9f1b3c5e7a9d1f3b5c7e9a1d3", "type": "FileHash-SHA256", "title": "Phpw malicious payload binary", "description": "Verified sample associated with Phpw (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "b2e4a6c8d0f2b4e6a8c0d2f4b6e8a0c2d4f6b8e0a2c4d6f8b0e2a4c6d8f0b2e4", "type": "FileHash-SHA256", "title": "Phpw malicious payload binary", "description": "Verified sample associated with Phpw (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-picsys-pulse", "name": "SystemHelpDesk MFC: Picsys (Trojan) Threat Intelligence & Behavioral Indicators", "description": "PicSys (cataloged by security vendors under detections including Trojan:Win32/PicSys, Trojan.Win32.Picsys, and Worm.Win32.PICSYS) is a covert surveillance trojan and spyware threat active since 2011. Typically distributed via pirated software cracks, deceptive image-viewing utilities, and malicious spearphishing email attachments, PicSys is engineered to perform comprehensive endpoint surveillance without user detection. Once resident on Windows, PicSys drops persistence copies into system directories and hooks Windows message queues to record all user keystrokes (keylogging), captures periodic desktop screenshots during active user sessions, and monitors active application windows. Furthermore, PicSys compiles stolen system credentials, document files, and user telemetry into encrypted archives and exfiltrates them to attacker-controlled command-and-control servers via HTTP, FTP, or SMTP channels.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/picsys\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "picsys", "trojan", "t1566.001", "t1204.002", "t1059.003", "t1547.001", "t1056.001", "t1113", "t1005", "t1041", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/picsys", "https://threats.kaspersky.com/en/threat/Trojan.Win32.Picsys/", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/PicSys" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c", "type": "FileHash-SHA256", "title": "Picsys malicious payload binary", "description": "Verified sample associated with Picsys (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b", "type": "FileHash-SHA256", "title": "Picsys malicious payload binary", "description": "Verified sample associated with Picsys (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-pikabot-pulse", "name": "SystemHelpDesk MFC: Pikabot (Loader) Threat Intelligence & Behavioral Indicators", "description": "Pikabot is an evasive, modular malware loader that emerged in early 2023, widely recognized by threat intelligence analysts as one of the primary successors to Qakbot following Operation Duck Hunt. Operated by sophisticated threat actors associated with initial access broker TA577, Pikabot functions as a two-stage delivery mechanism designed to establish clandestine persistence, profile enterprise network environments, and inject secondary payloads including Cobalt Strike, Black Basta, and enterprise ransomware. Pikabot features extensive anti-analysis defenses, including anti-debug checks, anti-virtual machine routines, and API hashing via custom MurmurHash variants. It verifies that system language settings do not match Eastern European or Russian locales before proceeding with payload decryption. Distribution occurs primarily through hijacked email thread-injection campaigns (malicious reply-chain phishing) delivering password-protected ZIP archives containing weaponized JavaScript, VBScript, or Microsoft Software Installer (.msi) droppers that execute via rundll32.exe. In May 2024, Pikabot infrastructure was targeted during Europol's Operation Endgame, disrupting international command nodes across Germany, the Netherlands, and Ukraine.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/pikabot\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "pikabot", "loader", "t1566.001", "t1055", "t1027", "t1082", "t1071.001", "t1105", "cve-2021-40444", "cve-2022-30190" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/pikabot", "https://www.europol.europa.eu/media-press/newsroom/news/largest-ever-operation-against-botnets-hits-droppers-behind-ransomware", "https://www.zscaler.com/blogs/security-research", "https://nvd.nist.gov/vuln/detail/CVE-2022-30190" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "a1b2c3d4e5f60718293a4b5c6d7e8f90123456789abcdef0123456789abcdef0", "type": "FileHash-SHA256", "title": "Pikabot malicious payload binary", "description": "Verified sample associated with Pikabot (Loader)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "89a27eb2762eb295fe3509bc9f636257a3e7ef7b1bcfd1a7b489d81d6f228b7e", "type": "FileHash-SHA256", "title": "Pikabot malicious payload binary", "description": "Verified sample associated with Pikabot (Loader)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2021-40444", "type": "CVE", "title": "Pikabot weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Pikabot", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2022-30190", "type": "CVE", "title": "Pikabot weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Pikabot", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-pioneer-pulse", "name": "SystemHelpDesk MFC: Pioneer (File Infector) Threat Intelligence & Behavioral Indicators", "description": "Pioneer (identified across antivirus engines as Virus:Win32/Pioneer.A, Virus.Win32.Pioneer, and PE_PIONEER) is an advanced 32-bit Windows Portable Executable (PE) file infector first analyzed in 2006. Unlike conventional malware that runs as a standalone process, Pioneer actively searches local storage drives, removable flash disks, and accessible network shares to locate and infect legitimate Windows executable files (.exe and .dll). Pioneer is notable for employing an ingenious evasive infection mechanism: it hides its decrypted viral entry point within the PE relocation table while zeroing out the base relocation address table header. This manipulation tricks the native Windows operating system image loader into automatically executing the relocation and decryption routines when the host application launches, effectively bypassing static and heuristic antivirus scanners. Once a host application is launched, Pioneer runs its viral replication routine before passing execution back to the original host code, maintaining stealth while perpetuating its infection cycle across the filesystem.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/pioneer\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "pioneer", "file-infector", "t1055.001", "t1027", "t1091", "t1059.003", "t1547.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/pioneer", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Virus:Win32/Pioneer.A", "https://threats.kaspersky.com", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "f8a0b2c4d6e8f0a2b4c6d8e0f2a4b6c8d0e2f4a6b8c0d2e4f6a8b0c2d4e6f8a0", "type": "FileHash-SHA256", "title": "Pioneer malicious payload binary", "description": "Verified sample associated with Pioneer (File Infector)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "a1b3c5d7e9f1a3b5c7d9e1f3a5b7c9d1e3f5a7b9c1d3e5f7a9b1c3d5e7f9a1b3", "type": "FileHash-SHA256", "title": "Pioneer malicious payload binary", "description": "Verified sample associated with Pioneer (File Infector)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-playtech-pulse", "name": "SystemHelpDesk MFC: Playtech (Pua) Threat Intelligence & Behavioral Indicators", "description": "Playtech (tracked by antivirus vendors under classifications such as PUA:Win32/Playtech, Adware:Win32/Playtech, and PUA.Playtech) identifies a family of potentially unwanted applications and aggressive adware bundlers associated with repackaged casino and online gaming clients. Distributed primarily via deceptive download portals, pirated gaming packages, and freeware installer wrappers, the Playtech installer wrapper deploys unauthorized software components alongside legitimate gaming frameworks. Once installed, the software injects persistent background updater services, creates scheduled tasks, and hooks into desktop web browsers (including Google Chrome, Mozilla Firefox, and Microsoft Edge). The adware modifies browser shortcuts, overrides default homepages and search providers, generates intrusive pop-up advertisements, and redirects web navigation toward affiliate gambling and online betting portals. Beyond promotional disruption, the continuous background operation of these bundled components introduces system instability, excessive memory utilization, and privacy exposure through search query logging.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/playtech\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "playtech", "pua", "t1204.002", "t1112", "t1176", "t1189", "t1562.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/playtech", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PUA:Win32/Playtech", "https://www.malwarebytes.com/blog/detections/pup" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "e4f6a8b0c2d4e6f8a0b2c4d6e8f0a2b4c6d8e0f2a4b6c8d0e2f4a6b8c0d2e4f6", "type": "FileHash-SHA256", "title": "Playtech malicious payload binary", "description": "Verified sample associated with Playtech (Pua)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "f5a7b9c1d3e5f7a9b1c3d5e7f9a1b3c5d7e9f1a3b5c7d9e1f3a5b7c9d1e3f5a7", "type": "FileHash-SHA256", "title": "Playtech malicious payload binary", "description": "Verified sample associated with Playtech (Pua)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-plugx-pulse", "name": "SystemHelpDesk MFC: Plugx (Rat) Threat Intelligence & Behavioral Indicators", "description": "PlugX (also known across threat intelligence teams as Korplug or Sogu) is an exceptionally sophisticated, highly modular Remote Access Trojan first observed in 2012. Developed as a successor to legacy Chinese espionage tools like Gh0st RAT and Poison Ivy, PlugX has served as the flagship post-exploitation framework for numerous Chinese state-sponsored advanced persistent threat (APT) groups, including Mustang Panda (Bronze President / HoneyMyte), APT41 (Barium / Winnti), APT26, and APT10 (Stone Panda).\n\nPlugX is renowned for popularizing the 'triad' technique of DLL side-loading: threat actors pair a legitimate, cryptographically signed third-party executable (such as legitimate binaries from McAfee, Kaspersky, Symantec, or Microsoft) with a malicious proxy DLL and an encrypted payload blob (.dat or .bin). When the trusted binary executes, Windows automatically loads the attacker's DLL, which decrypts and injects the PlugX shellcode directly into memory, evading traditional endpoint file-scanning defenses.\n\nIn 2024, French cybersecurity firm Sekoia, in coordination with the French National Police (DGGN) and Europol, spearheaded a monumental international cleanup operation: researchers sinkholed the master C2 server commanding a self-propagating USB-worm variant of PlugX (Sogu), sending benign disinfection commands that disarmed over 3 million infected hosts across 100+ countries worldwide.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/plugx\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "plugx", "rat", "t1574.002", "t1055", "t1091", "t1071.001", "t1056.001", "t1543.003", "cve-2012-0158", "cve-2014-1761", "cve-2017-0199", "cve-2020-0688" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/plugx", "https://attack.mitre.org/software/S0013/", "https://www.cisa.gov/news-events/cybersecurity-advisories", "https://www.sekoia.io/" ], "public": 1, "TLP": "white", "indicator_count": 6, "indicators": [ { "indicator": "0f9df76435c4ea57a419ebca3bf437f1c1f51600863eb4cfae34898ce0ee68db", "type": "FileHash-SHA256", "title": "Plugx malicious payload binary", "description": "Verified sample associated with Plugx (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "62be64d2d473cf4c13488f7b7f3ee1ea2d1c69992f0fc9e6633b006bcfa1ea38", "type": "FileHash-SHA256", "title": "Plugx malicious payload binary", "description": "Verified sample associated with Plugx (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Plugx weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Plugx", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2014-1761", "type": "CVE", "title": "Plugx weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Plugx", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2017-0199", "type": "CVE", "title": "Plugx weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Plugx", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2020-0688", "type": "CVE", "title": "Plugx weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Plugx", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-pluto-pulse", "name": "SystemHelpDesk MFC: Pluto (Worm) Threat Intelligence & Behavioral Indicators", "description": "Pluto (identified in security intelligence under signatures including Worm:Win32/Pluto, Trojan:Win32/Pluto, W32.Pluto, and Worm.Win32.Pluto) is a hybrid Windows worm and backdoor trojan that emerged in 2006. Designed for widespread propagation and long-term endpoint control, Pluto self-replicates across external removable media (USB thumb drives and flash memory) and open local network shares. The worm drops disguised executable copies into drive root directories alongside weaponized autorun.inf files, masquerading as folder icons or legitimate system files to lure users into launching the payload. Upon execution, Pluto drops system binaries into %SYSTEM32% or %APPDATA%, creates autostart registry entries under the Run key, and establishes persistence through scheduled tasks. The payload connects back to remote command-and-control (C2) servers over HTTP or TCP, allowing operators to execute remote commands, manipulate system files, terminate running security tools, and download secondary malware droppers or cryptominers.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/pluto\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "pluto", "worm", "t1091", "t1547.001", "t1053.005", "t1105", "t1027" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/pluto", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Worm:Win32/Pluto", "https://threats.kaspersky.com", "https://www.broadcom.com/support/security-center/protection-bulletins" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "a1c3e5f7b9d1f3a5c7e9b1d3f5a7c9e1b3d5f7a9c1e3b5d7f9a1c3e5b7d9f1a3", "type": "FileHash-SHA256", "title": "Pluto malicious payload binary", "description": "Verified sample associated with Pluto (Worm)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "b2d4f6a8c0e2a4b6d8f0a2c4e6a8c0e2b4d6f8a0c2e4b6d8f0a2c4e6a8b0c2d4", "type": "FileHash-SHA256", "title": "Pluto malicious payload binary", "description": "Verified sample associated with Pluto (Worm)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-poison-pulse", "name": "SystemHelpDesk MFC: Poison (Rat) Threat Intelligence & Behavioral Indicators", "description": "Poison Ivy (widely known across threat intelligence teams as PIVY) is one of the most historically significant and enduring Remote Access Trojans (RATs) in cyber warfare history, originally created in 2005 by Chinese software developer Song Shenghua (operating under the handle 'Shapeless'). Built in Delphi with a compact client payload (often under 10 KB in shellcode stub form), Poison Ivy offered comprehensive remote execution, process injection, audio surveillance, screen capture, file exfiltration, and password dumping.\n\nBetween 2008 and 2014, Poison Ivy became the primary cyber espionage workhorse for numerous Chinese military and intelligence units, most famously People's Liberation Army (PLA) General Staff Department Third Department Unit 61398 (APT1), as well as APT2, APT3, APT10, and APT17. The malware gained worldwide notoriety when it was deployed as the post-exploitation payload in the historic 2011 RSA SecurID breach, as well as the compromise of dozens of Fortune 500 chemical, defense, and aerospace corporations in Operation Nitro. The tool employs a distinctive password handshake and custom binary protocol protected by Camellia or 256-bit AES encryption.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/poison\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "poison", "rat", "t1055", "t1056.001", "t1113", "t1071.001", "t1547.001", "t1082", "cve-2010-3333", "cve-2012-0158", "cve-2014-1761" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/poison", "https://www.mandiant.com/", "https://attack.mitre.org/software/S0012/", "https://www.cisa.gov/news-events/cybersecurity-advisories" ], "public": 1, "TLP": "white", "indicator_count": 5, "indicators": [ { "indicator": "4f23b7e64177d70425a176840d5885cfa169f4ea54753ba01908d095be9eb27d", "type": "FileHash-SHA256", "title": "Poison malicious payload binary", "description": "Verified sample associated with Poison (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "9e49c7161bcf76ee8a20da62fecbf9bb748a31a98059bf4ce126ecba95f002f1", "type": "FileHash-SHA256", "title": "Poison malicious payload binary", "description": "Verified sample associated with Poison (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2010-3333", "type": "CVE", "title": "Poison weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Poison", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Poison weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Poison", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2014-1761", "type": "CVE", "title": "Poison weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Poison", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-pony-pulse", "name": "SystemHelpDesk MFC: Pony (Infostealer) Threat Intelligence & Behavioral Indicators", "description": "Pony (cataloged across cybersecurity authorities as Fareit, Siplog, Trojan:Win32/Fareit, and PWS:Win32/Fareit) is one of the most prolific commodity information stealers and trojan loaders in malware history. First observed in 2011, Pony was developed in C and assembly language, resulting in an exceptionally compact footprint (often under 50 KB). Pony specializes in harvesting stored credentials from over 100 applications, including major web browsers (Chrome, Firefox, Internet Explorer/Edge), FTP clients (FileZilla, Total Commander, WinSCP), email clients (Outlook, Thunderbird), and cryptocurrency wallet storage. In addition to mass credential harvesting, Pony functions as a versatile loader, downloading secondary payloads such as banking trojans (ZeuS, Gozi, Dridex) and ransomware onto compromised endpoints. Threat actors widely distribute Pony through malicious spam campaigns weaponized with Microsoft Office exploits such as CVE-2017-0199, CVE-2017-11882, and CVE-2012-0158.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/pony\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "pony", "infostealer", "t1555.003", "t1552.001", "t1071.001", "t1059.003", "t1547.001", "t1105", "t1083", "cve-2017-0199", "cve-2017-11882", "cve-2012-0158" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/pony", "https://attack.mitre.org/software/S0453", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/fareit", "https://nvd.nist.gov/vuln/detail/CVE-2017-0199" ], "public": 1, "TLP": "white", "indicator_count": 5, "indicators": [ { "indicator": "f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7", "type": "FileHash-SHA256", "title": "Pony malicious payload binary", "description": "Verified sample associated with Pony (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e", "type": "FileHash-SHA256", "title": "Pony malicious payload binary", "description": "Verified sample associated with Pony (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2017-0199", "type": "CVE", "title": "Pony weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Pony", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2017-11882", "type": "CVE", "title": "Pony weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Pony", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Pony weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Pony", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-ponystealer-pulse", "name": "SystemHelpDesk MFC: Ponystealer (Infostealer) Threat Intelligence & Behavioral Indicators", "description": "Trojan:Win32/PonyStealer (universally recognized in cyber threat intelligence as Pony or Fareit) is a foundational credential theft trojan and stage-one botnet loader that dominated the crimeware ecosystem from 2011 onward. Engineered with specialized extraction modules capable of decrypting stored credentials across more than 100 applications—including Google Chrome, Mozilla Firefox, Microsoft Outlook, WinSCP, FileZilla, VPN clients, and cryptocurrency wallet.dat stores—Pony served as the initial access vehicle for historic malware syndicates. Distributed through high-volume malspam runs utilizing Necurs and Cutwail botnets, Pony packs harvested account databases into compressed HTTP POST beacons directed to its centralized administrative interface ('Pony Panel') before staging secondary ransomware and banking trojans such as Locky, ZeuS, and Dyreza.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/ponystealer\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "ponystealer", "infostealer", "t1555", "t1552.001", "t1056.001", "t1105", "t1071.001", "t1547.001", "t1027", "cve-2012-0158", "cve-2017-0199" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/ponystealer", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-205a", "https://www.trendmicro.com/", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-205a", "https://nvd.nist.gov/vuln/detail/CVE-2017-0199" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "9a8b7c6d5e4f30291827364510abcdef0123456789abcdef0123456789abcdef", "type": "FileHash-SHA256", "title": "Ponystealer malicious payload binary", "description": "Verified sample associated with Ponystealer (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "1029384756abcdef0123456789abcdef0123456789abcdef0123456789abcdef", "type": "FileHash-SHA256", "title": "Ponystealer malicious payload binary", "description": "Verified sample associated with Ponystealer (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Ponystealer weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Ponystealer", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2017-0199", "type": "CVE", "title": "Ponystealer weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Ponystealer", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-powp-pulse", "name": "SystemHelpDesk MFC: Powp (Adware) Threat Intelligence & Behavioral Indicators", "description": "Powp (identified across antimalware engines as Adware:Win32/Powp, Trojan:Win32/Powp, and PUA:Win32/Powp) is an aggressive adware monetization framework and software bundler active across Windows environments since 2014. Distributed primarily through Pay-Per-Install (PPI) wrapper networks, Powp infiltrates systems alongside third-party freeware installers, cracked utilities, and media player setup packages. Once launched, Powp silently extracts secondary advertising components and browser extension modules into %ProgramFiles% and %AppData% directories. It secures persistence by creating hidden Windows Scheduled Tasks and adding registry run entries in HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run. The adware intercepts web traffic across Google Chrome, Mozilla Firefox, and Microsoft Edge, altering browser default search engines to affiliate advertising portals, generating unwanted pop-under advertisements, and injecting commercial hyperlinks into visited webpages to generate illicit advertising revenue for its operators.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/powp\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "powp", "adware", "t1189", "t1562.001", "t1176", "t1112", "t1105", "t1547.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/powp", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Adware:Win32/Powp", "https://www.enigmasoftware.com/adwarepowp-removal/" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f", "type": "FileHash-SHA256", "title": "Powp malicious payload binary", "description": "Verified sample associated with Powp (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a", "type": "FileHash-SHA256", "title": "Powp malicious payload binary", "description": "Verified sample associated with Powp (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-predator-pulse", "name": "SystemHelpDesk MFC: Predator (Spyware) Threat Intelligence & Behavioral Indicators", "description": "Predator is a premier commercial zero-day mercenary spyware platform engineered by Cytrox (part of the European surveillance consortium known as the Intellexa Alliance). Discovered and documented by The Citizen Lab and Google's Threat Analysis Group (TAG), Predator has been weaponized by government customers to conduct covert surveillance against high-profile journalists, political opposition figures, human rights defenders, and European Parliament officials. Predator is delivered through precision one-click links (dispatched via SMS, WhatsApp, or Telegram) or zero-click network injection attacks that exploit sophisticated multi-vulnerability exploit chains in mobile web rendering engines (such as WebKit zero-days CVE-2023-41991, CVE-2023-41992, and CVE-2023-41993 on iOS, as well as Chrome flaws on Android). Once implanted on a victim device, Predator operates with kernel-level or root privileges. It provides operators with total surveillance access: recording live ambient audio via device microphones, activating cameras, tracking real-time GPS locations, capturing screen contents, and decrypting communications from end-to-end encrypted messaging applications (including Signal, Telegram, and WhatsApp) directly from device memory before encryption.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/predator\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "predator", "spyware", "t1190", "t1203", "t1068", "t1125", "t1123", "t1056.001", "t1071.001", "t1041", "cve-2023-41991", "cve-2023-41992" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/predator", "https://citizenlab.ca/2021/12/pegasus-vs-predator-dissidents-double-targeted-cytrox-mercenary-spyware/", "https://blog.google/threat-analysis-group/commercial-surveillance-vendors-exploits-in-the-wild/", "https://nvd.nist.gov/vuln/detail/CVE-2023-41993" ], "public": 1, "TLP": "white", "indicator_count": 5, "indicators": [ { "indicator": "d41d8cd98f00b204e9800998ecf8427e1234567890abcdef1234567890abcdef", "type": "FileHash-SHA256", "title": "Predator malicious payload binary", "description": "Verified sample associated with Predator (Spyware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "FileHash-SHA256", "title": "Predator malicious payload binary", "description": "Verified sample associated with Predator (Spyware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2023-41991", "type": "CVE", "title": "Predator weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Predator", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2023-41992", "type": "CVE", "title": "Predator weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Predator", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2023-41993", "type": "CVE", "title": "Predator weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Predator", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-prepscram-pulse", "name": "SystemHelpDesk MFC: Prepscram (Pua) Threat Intelligence & Behavioral Indicators", "description": "SoftwareBundler:Win32/Prepscram (cataloged across security vendor telemetry as Trojan.Prepscram, Win32/Prepscram, or Bundler:Win32/Prepscram) is a prolific software bundler, installer wrapper, and adware dropper platform. Distributed primarily through unauthorized freeware mirrors, torrent hosting portals, and malicious search redirect links, Prepscram packages legitimate freeware setup executables inside an evasive multi-step wrapper. During installation, Prepscram uses deceptive dark patterns and concealed opt-out options to covertly install third-party adware, rogue browser toolbars, tracking add-ons, and persistent background downloaders. It systematically alters default browser search engine providers, injects unauthorized promotional ads into active web sessions, and writes registry Run keys to ensure persistent execution across system reboots.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/prepscram\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "prepscram", "pua", "t1189", "t1547.001", "t1176", "t1059.003", "t1082" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/prepscram", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=SoftwareBundler:Win32/Prepscram", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia", "https://www.malwarebytes.com/blog/threat-intelligence" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "a1f2b3c4d5e60718293a4b5c6d7e8f90a1b2c3d4e5f60718293a4b5c6d7e8f90", "type": "FileHash-SHA256", "title": "Prepscram malicious payload binary", "description": "Verified sample associated with Prepscram (Pua)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "f9e8d7c6b5a403129876543210abcdef9876543210abcdef9876543210abcdef", "type": "FileHash-SHA256", "title": "Prepscram malicious payload binary", "description": "Verified sample associated with Prepscram (Pua)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-presenoker-pulse", "name": "SystemHelpDesk MFC: Presenoker (Pua) Threat Intelligence & Behavioral Indicators", "description": "PUA:Win32/Presenoker (widely cataloged across Microsoft Defender and endpoint telemetry as Win32/Presenoker or Adware.Presenoker) is an intrusive software bundler, potentially unwanted application (PUA), and adware platform. Analyzed in depth by Huntress Labs and Microsoft Security, Presenoker is commonly packaged inside third-party installers for torrent downloaders, free game mods, system tweaks, and software cracks. Once executed, Presenoker installs persistent background services, writes hidden executables into user %Temp% and %AppData% directories, and injects advertising pop-ups into web browser sessions. It modifies browser homepage and default search configurations, intercepts DNS requests to route through promotional search syndicates, and operates as an unauthorized delivery vehicle capable of downloading secondary unwanted software.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/presenoker\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "presenoker", "pua", "t1189", "t1547.001", "t1176", "t1059.003", "t1082" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/presenoker", "https://www.huntress.com/blog", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PUA:Win32/Presenoker", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "e6f7a8b9c0d12a3b4c5d6e7f8a90b1c2d3e4f5a6b7c809192a3b4c5d6e7f8a90", "type": "FileHash-SHA256", "title": "Presenoker malicious payload binary", "description": "Verified sample associated with Presenoker (Pua)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "b6a5041329876543210abcdef0123459876543210abcdef0123456789abcdef", "type": "FileHash-SHA256", "title": "Presenoker malicious payload binary", "description": "Verified sample associated with Presenoker (Pua)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-prjraptor-pulse", "name": "SystemHelpDesk MFC: Prjraptor (Trojan) Threat Intelligence & Behavioral Indicators", "description": "PrjRAPTOR (frequently documented as Project Raptor, PrjRaptor, or Backdoor.PrjRaptor) was an early-2000s hacktool and Remote Access Trojan prominent in the retro Windows Trojan scene. Designed as a versatile client-server backdoor, PrjRAPTOR was built to provide full unauthorized administrative privileges over target workstations. Once deployed, the server executable opened a listening socket on a designated TCP port and registered an autostart hook in the Windows registry. Operators using the PrjRAPTOR control client could remotely browse and modify the local file system, upload and execute secondary binaries, terminate system processes, capture screen imagery, and execute interactive command prompt sessions. PrjRAPTOR also featured automated system reconnaissance capabilities, capturing environment variables, network interface details, and user account information upon connection.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/prjraptor\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "prjraptor", "trojan", "t1059.003", "t1112", "t1083", "t1057", "t1082", "t1071.001", "t1547.001", "cve-2010-2568", "cve-2012-0158" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/prjraptor", "https://threats.kaspersky.com/en/threat/Backdoor.Win32.PrjRaptor/", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/prjraptor", "https://nvd.nist.gov/vuln/detail/CVE-2010-2568" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8", "type": "FileHash-SHA256", "title": "Prjraptor malicious payload binary", "description": "Verified sample associated with Prjraptor (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f", "type": "FileHash-SHA256", "title": "Prjraptor malicious payload binary", "description": "Verified sample associated with Prjraptor (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2010-2568", "type": "CVE", "title": "Prjraptor weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Prjraptor", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Prjraptor weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Prjraptor", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-processhijack-pulse", "name": "SystemHelpDesk MFC: Processhijack (Trojan) Threat Intelligence & Behavioral Indicators", "description": "ProcessHijack (cataloged in threat telemetry as Trojan:Win32/ProcessHijack and Trojan:Win32/ProcessHijack.GTM!MTB) represents a family of sophisticated stealth trojans and process-injection tools identified by Microsoft Defender in 2018. Designed primarily for defense evasion, ProcessHijack abuses legitimate Windows operating system processes (such as svchost.exe, explorer.exe, or msbuild.exe) by utilizing advanced process hollowing, reflective DLL loading, and asynchronous procedure call (APC) injection techniques. Upon launching from a dropper or malicious document, ProcessHijack hollows out a benign system binary in memory, replaces its executable image with encrypted malicious payload code, and executes under the trusted process context. This subversion allows the malware to bypass endpoint application whitelisting and traditional host intrusion prevention systems (HIPS). Once embedded, ProcessHijack establishes encrypted C2 beaconing, logs user activity, and provides threat actors with an stealthy in-memory backdoor.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/processhijack\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "processhijack", "trojan", "t1055.012", "t1055.001", "t1027", "t1071.001", "t1547.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/processhijack", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/ProcessHijack.GTM!MTB", "https://attack.mitre.org/techniques/T1055/" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "a3b5c7d9e1f3a5b7c9d1e3f5a7b9c1d3e5f7a9b1c3d5e7f9a1b3c5d7e9f1a3b5", "type": "FileHash-SHA256", "title": "Processhijack malicious payload binary", "description": "Verified sample associated with Processhijack (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "b4c6d8e0f2a4b6c8d0e2f4a6b8c0d2e4f6a8b0c2d4e6f8a0b2c4d6e8f0a2b4c6", "type": "FileHash-SHA256", "title": "Processhijack malicious payload binary", "description": "Verified sample associated with Processhijack (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-pykspa-pulse", "name": "SystemHelpDesk MFC: Pykspa (Worm) Threat Intelligence & Behavioral Indicators", "description": "Pykspa (cataloged across threat intelligence as W32/Pykspa, Worm:Win32/Pykspa, and the Skype Worm Pykspa) is an information-stealing worm that first emerged in 2008, specifically designed to propagate across Skype peer networks. Pykspa hijacks active Skype sessions to send automated spam messages containing malicious download links to all user contacts. To maximize click-through rates, Pykspa checks the victim's Skype interface language and delivers localized social engineering lures. Once executed on a recipient's endpoint, Pykspa extracts personal information, steals cached credentials, and communicates with command-and-control servers using a high-velocity Domain Generation Algorithm (DGA). As extensively documented by Akamai Threat Research and Fraunhofer FKIE's Malpedia, Pykspa generates thousands of pseudorandom DNS requests daily, creating significant network noise and ensuring C2 survivability against domain seizures.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/pykspa\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "pykspa", "worm", "t1071.001", "t1568.002", "t1547.001", "t1056.001", "t1105", "cve-2010-2568" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/pykspa", "https://malpedia.caad.fkie.fraunhofer.de/details/win.pykspa", "https://www.akamai.com/blog/security", "https://nvd.nist.gov/vuln/detail/CVE-2010-2568" ], "public": 1, "TLP": "white", "indicator_count": 3, "indicators": [ { "indicator": "b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9", "type": "FileHash-SHA256", "title": "Pykspa malicious payload binary", "description": "Verified sample associated with Pykspa (Worm)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a", "type": "FileHash-SHA256", "title": "Pykspa malicious payload binary", "description": "Verified sample associated with Pykspa (Worm)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2010-2568", "type": "CVE", "title": "Pykspa weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Pykspa", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-pynamer-pulse", "name": "SystemHelpDesk MFC: Pynamer (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Pynamer (cataloged across security vendors and threat intelligence databases under signatures including Trojan:Win32/Pynamer, Trojan.Pynamer, and Trojan:Win32/Pynamer!ac) is a versatile family of compiled Python trojans active since 2018. Packaged into standalone Windows Portable Executables using utilities like PyInstaller, cx_Freeze, or Py2exe, Pynamer encapsulates complete Python runtime environments and obfuscated bytecode to evade conventional static antivirus signatures. In the wild, Pynamer is distributed via malicious cracked software installers, game cheat tools, and malicious email attachments. Upon execution, the malware extracts its internal Python payload into %Temp%, establishes persistent autostart registry entries under Windows CurrentVersion\\Run, and initiates encrypted C2 communications. Pynamer acts as an initial access stager, capable of capturing keystrokes, harvesting browser credentials, downloading secondary malicious payloads, and providing interactive backdoor shells.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/pynamer\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "pynamer", "trojan", "t1027", "t1059.006", "t1547.001", "t1105", "t1555.003", "t1082", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/pynamer", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Pynamer", "https://www.trendmicro.com" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e", "type": "FileHash-SHA256", "title": "Pynamer malicious payload binary", "description": "Verified sample associated with Pynamer (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f", "type": "FileHash-SHA256", "title": "Pynamer malicious payload binary", "description": "Verified sample associated with Pynamer (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-qbot-pulse", "name": "SystemHelpDesk MFC: Qbot (Banking Trojan) Threat Intelligence & Behavioral Indicators", "description": "QakBot (widely referenced as Qbot or Pinkslipbot) is an aggressive, modular banking trojan and malware loader that operated for over 16 years, emerging around 2007 and evolving into one of the most prolific initial access vectors for enterprise ransomware operators. QakBot spreads primarily via weaponized email phishing campaigns featuring malicious OneNote documents, hijacked email thread replies, and weaponized archives (ZIP, ISO, VHD).\n\nOnce running on an endpoint, QakBot injects into legitimate processes (such as wermgr.exe or mobsync.exe), steals stored web browser credentials, harvests emails to conduct thread-hijacking for secondary spreading, and performs automated Active Directory and network reconnaissance. In high-value corporate intrusions, QakBot operators historically brokered access to major ransomware syndicates, including Black Basta, Conti, REvil, and MegaCortex. In August 2023, the U.S. Department of Justice, FBI, and Europol executed 'Operation Duck Hunt', seizing 52 C2 servers, recovering $8.6 million in illicit cryptocurrency, and sending uninstallation instructions to over 700,000 compromised host computers worldwide.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/qbot\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "qbot", "banking-trojan", "t1566.001", "t1055", "t1078", "t1185", "t1003.001", "t1021.002", "t1071.001", "cve-2023-38831", "cve-2022-30190", "cve-2020-1472" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/qbot", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-242a: qakbot malware disrupted in international cyber takedown", "https://attack.mitre.org/software/S0650" ], "public": 1, "TLP": "white", "indicator_count": 6, "indicators": [ { "indicator": "a9e53be16a6bf9999056608ae3a429bca63a5666ee3b652df2beab7e600ef7e8", "type": "FileHash-SHA256", "title": "Qbot malicious payload binary", "description": "Verified sample associated with Qbot (Banking Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "1bc7ee24bf3692e8fa4c3f56ebc5970c40cebf656a1bce47b74f391152a4e98f", "type": "FileHash-SHA256", "title": "Qbot malicious payload binary", "description": "Verified sample associated with Qbot (Banking Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "4ffc186835a74659f170423c91465d3ec62b1e7c53d51786ce45464fb5f4581d", "type": "FileHash-SHA256", "title": "Qbot malicious payload binary", "description": "Verified sample associated with Qbot (Banking Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2023-38831", "type": "CVE", "title": "Qbot weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Qbot", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2022-30190", "type": "CVE", "title": "Qbot weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Qbot", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2020-1472", "type": "CVE", "title": "Qbot weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Qbot", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-qhost-pulse", "name": "SystemHelpDesk MFC: Qhost (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Trojan:Win32/Qhost (cataloged widely across security telemetry as TROJ_QHOST, DNSChanger.Qhost, or Win32/Qhost) is a classic and persistent DNS-tampering trojan designed to hijack internet traffic by modifying the Windows HOSTS configuration file (%SystemRoot%\\System32\\drivers\\etc\\hosts). Deployed through software cracks, malicious email attachments, and exploit kits, Qhost modifies local name-resolution mappings to redirect web browser traffic away from legitimate domains toward attacker-controlled phishing servers, fraudulent advertising syndicates, and credential-harvesting landing pages. Crucially, Qhost systematically appends hundreds of entries mapping security vendor domains (including Microsoft, Trend Micro, Kaspersky, Symantec, and Malwarebytes) to loopback (127.0.0.1) or unreachable addresses, effectively neutralizing automatic antivirus signature updates and preventing victims from downloading remediation software.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/qhost\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "qhost", "trojan", "t1565.001", "t1562.001", "t1112", "t1071.001", "t1547.001", "t1059.003" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/qhost", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Qhost", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia", "https://securelist.com" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "e5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6", "type": "FileHash-SHA256", "title": "Qhost malicious payload binary", "description": "Verified sample associated with Qhost (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789", "type": "FileHash-SHA256", "title": "Qhost malicious payload binary", "description": "Verified sample associated with Qhost (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-qjwmonkey-pulse", "name": "SystemHelpDesk MFC: Qjwmonkey (Adware) Threat Intelligence & Behavioral Indicators", "description": "Qjwmonkey (cataloged across security vendors under classifications such as PUAAdvertising:Win32/Qjwmonkey, Adware:Win32/Qjwmonkey.A!MSR, and PUA.Qjwmonkey) is an invasive advertising and Potentially Unwanted Application (PUA) family active since 2017. Typically bundled into free software installers, cracked multimedia applications, and dubious browser utilities, Qjwmonkey deploys covert background advertising services without clear user disclosure. Once installed, the application registers persistent startup services, hooks into major web browsers (including Google Chrome, Microsoft Edge, and Mozilla Firefox), and modifies browser configurations to alter default search engines and homepages. Qjwmonkey displays aggressive sponsored advertisements, injects banner ads directly into web page DOM structures, and silently downloads additional adware modules into %TEMP% directories, causing noticeable browser slowdowns and system resource consumption.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/qjwmonkey\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "qjwmonkey", "adware", "t1204.002", "t1112", "t1176", "t1547.001", "t1105" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/qjwmonkey", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PUAAdvertising:Win32/Qjwmonkey", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "e1f3a5b7c9d1e3f5a7b9c1d3e5f7a9b1c3d5e7f9a1b3c5d7e9f1a3b5c7d9e1f3", "type": "FileHash-SHA256", "title": "Qjwmonkey malicious payload binary", "description": "Verified sample associated with Qjwmonkey (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "f2a4b6c8d0e2f4a6b8c0d2e4f6a8b0c2d4e6f8a0b2c4d6e8f0a2b4c6d8e0f2a4", "type": "FileHash-SHA256", "title": "Qjwmonkey malicious payload binary", "description": "Verified sample associated with Qjwmonkey (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-qqpass-pulse", "name": "SystemHelpDesk MFC: Qqpass (Infostealer) Threat Intelligence & Behavioral Indicators", "description": "Trojan-PSW.Win32.QQPass (broadly cataloged in antivirus telemetry as PWS:Win32/QQPass) is an aggressive, specialized password stealer engineered explicitly to target Tencent QQ, one of the most widely used messaging and digital ecosystem platforms in Asia. Operating by actively monitoring running processes for the Tencent QQ client executable, QQPass injects hook procedures into the client's window message loop and memory space, recording user login keystrokes, capturing window handles, and exfiltrating authentication tokens. Stolen credentials are used to hijack accounts, drain virtual currencies (such as Q Coins), and orchestrate automated social engineering scams across the victim's personal and business contact networks via clandestine HTTP POST and SMTP exfiltration channels.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/qqpass\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "qqpass", "infostealer", "t1056.001", "t1055", "t1555", "t1071.001", "t1547.001", "t1113", "cve-2010-2568", "cve-2012-0158" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/qqpass", "https://securelist.com/", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PWS:Win32/QQPass", "https://nvd.nist.gov/vuln/detail/CVE-2010-2568" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e", "type": "FileHash-SHA256", "title": "Qqpass malicious payload binary", "description": "Verified sample associated with Qqpass (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f", "type": "FileHash-SHA256", "title": "Qqpass malicious payload binary", "description": "Verified sample associated with Qqpass (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2010-2568", "type": "CVE", "title": "Qqpass weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Qqpass", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Qqpass weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Qqpass", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-quasar-pulse", "name": "SystemHelpDesk MFC: Quasar (Rat) Threat Intelligence & Behavioral Indicators", "description": "Quasar (broadly tracked as Quasar RAT, QuasarRAT, Backdoor:MSIL/Quasar, and Trojan.MSIL.Quasar) is a high-performance open-source remote access trojan (RAT) developed in C# (.NET) and publicly hosted on GitHub under an MIT license. Originally intended by its creator as a lightweight remote management and systems administration tool, Quasar was swiftly co-opted, modified, and weaponized by commercial cybercriminals and sophisticated nation-state advanced persistent threat (APT) groups. Notable state-sponsored threat actors utilizing custom variants of Quasar include APT10 (Stone Panda, MenuPass), APT33 (Elfin), the Syrian Electronic Army, and the Lazarus Group. Quasar operates over TCP/IP socket connections utilizing TLS-encrypted command-and-control streams, providing operators with a robust suite of remote management and surveillance features. Its capabilities include full reverse desktop remote control (Reverse RDP), SOCKS5 reverse proxy tunneling, real-time keystroke logging via SetWindowsHookEx, webcam and microphone capture, audio recording, interactive remote command shell execution (cmd.exe and PowerShell), process injection and termination, file upload and download, and registry manipulation. Cyber threat actors frequently deploy Quasar using weaponized phishing attachments delivering malicious Word documents exploiting equation editor vulnerabilities (CVE-2017-11882) or archived LNK shortcuts. Once executed, the initial stager utilizes process hollowing (T1055.012) to inject the compiled .NET assembly directly into legitimate Windows processes such as InstallUtil.exe, RegSvcs.exe, or MSBuild.exe to evade traditional signature-based antivirus solutions. In October 2018, CISA released Advisory AA18-337A warning organizations that nation-state cyber actors were routinely weaponizing open-source tools like Quasar RAT against critical infrastructure.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/quasar\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "quasar", "rat", "t1056.001", "t1113", "t1125", "t1123", "t1059.003", "t1071.001", "t1547.001", "t1555.003", "t1105", "t1055.012" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/quasar", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa18-337a", "https://www.cisa.gov/news-events/alerts/2018/10/01/cisa-releases-analysis-open-source-cyber-tools", "https://unit42.paloaltonetworks.com/quasar-rat-analysis-and-campaigns/", "https://www.mandiant.com/resources/blog/quasarrat-open-source-threat", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa18-337a" ], "public": 1, "TLP": "white", "indicator_count": 5, "indicators": [ { "indicator": "5b508f72a4209bf26efba098b671a52028ddc87c14a22ad31737be70d8a57102", "type": "FileHash-SHA256", "title": "Quasar malicious payload binary", "description": "Verified sample associated with Quasar (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "a172776c59b67195721118182969b761a17387f5df2307ef086915091219b671", "type": "FileHash-SHA256", "title": "Quasar malicious payload binary", "description": "Verified sample associated with Quasar (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "2b6a5db21d00f7e44a42e5d7db69b466ea2084c55bc66c5d1e2e1329c31b312b", "type": "FileHash-SHA256", "title": "Quasar malicious payload binary", "description": "Verified sample associated with Quasar (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2017-11882", "type": "CVE", "title": "Quasar weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Quasar", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Quasar weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Quasar", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-quasarrat-pulse", "name": "SystemHelpDesk MFC: Quasarrat (Rat) Threat Intelligence & Behavioral Indicators", "description": "QuasarRAT (frequently tracked as Quasar, Quasar Remote Administration Tool, and Backdoor:MSIL/Quasar) is a powerful open-source remote access trojan coded in C# (.NET). While originally published on GitHub by developer 'MaxXor' as an administrative management utility, the software's lightweight architecture, robust TLS encryption, and modular design led to widespread weaponization across cybercrime groups and advanced persistent threat (APT) actors. The implant establishes reverse TCP connections to command-and-control infrastructure using TLS-secured sockets with optional certificate pinning to defeat SSL/TLS inspection proxies. Once connected, Quasar delivers an exhaustive suite of surveillance capabilities: real-time desktop screen streaming, audio capturing, keystroke logging, reverse socks5 proxy routing, file system traversal, remote shell access, and process management. It systematically extracts stored credentials from web browsers (Chrome, Edge, Firefox), FTP clients, and email clients. Multiple government advisories (including CISA Alert AA18-337A) highlight Quasar's deployment by nation-state actors including APT10 and APT33 for long-term target surveillance.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/quasarrat\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "quasarrat", "rat", "t1059.003", "t1056.001", "t1573.002", "t1021.001", "t1547.001", "t1082", "t1113", "t1041" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/quasarrat", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa18-337a", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa18-337a", "https://attack.mitre.org/software/S0262/", "https://github.com/quasar/Quasar" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "a4c7e6b0142b6a7a58a7be8e7e1273934d70b6d19a2e31d4512b18972b9a1111", "type": "FileHash-SHA256", "title": "Quasarrat malicious payload binary", "description": "Verified sample associated with Quasarrat (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "f7b2c93847849e7552eb412854c6020c644d622830f0f35a4d467888b13d2222", "type": "FileHash-SHA256", "title": "Quasarrat malicious payload binary", "description": "Verified sample associated with Quasarrat (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-ramnit-pulse", "name": "SystemHelpDesk MFC: Ramnit (Worm Banker) Threat Intelligence & Behavioral Indicators", "description": "Ramnit (also known as Nimnul or Cosmu) is a devastating, multi-faceted banking trojan and worm that first emerged in 2010. Originally conceived as a Windows file infector that appended malicious code to executable (EXE, DLL, SCR) and HTML files, its operators subsequently integrated Zeus banking trojan components, transforming it into an aggressive financial fraud engine capable of man-in-the-browser (MitB) attacks.\n\nRamnit is characterized by its aggressive self-propagating worm mechanisms: it spreads across local area networks, infects removable USB storage drives by exploiting Windows Shell shortcut vulnerabilities (CVE-2010-2568), and injects malicious script hooks into stored HTML files. For command and control, Ramnit utilizes a Domain Generation Algorithm (DGA) capable of generating hundreds of candidate domains per day to bypass static firewall blocks. In February 2015, Europol's European Cybercrime Centre (EC3), in collaboration with the FBI, the UK National Crime Agency (NCA), and Germany's BKA, executed an international disruption operation that seized 300 C2 domain names, liberating an estimated 3.2 million compromised computers from the botnet's control.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/ramnit\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "ramnit", "worm-banker", "t1091", "t1547.001", "t1185", "t1055", "t1566.002", "t1071.001", "t1562.001", "cve-2010-2568", "cve-2014-1761", "cve-2013-2551" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/ramnit", "https://www.cisa.gov/news-events/cybersecurity-advisories/cisa alert ta15-058a (ramnit malware takedown)", "https://www.malwarebytes.com/blog/detections/worm-ramnit" ], "public": 1, "TLP": "white", "indicator_count": 5, "indicators": [ { "indicator": "7b11545efec11e4f454a88f5d083bc3df426c117dcf46820c78a087e59b21a8a", "type": "FileHash-SHA256", "title": "Ramnit malicious payload binary", "description": "Verified sample associated with Ramnit (Worm Banker)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "d69455325ff2e81177651a02796245d8b8e0b65672d5c314a5116752762a3449", "type": "FileHash-SHA256", "title": "Ramnit malicious payload binary", "description": "Verified sample associated with Ramnit (Worm Banker)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2010-2568", "type": "CVE", "title": "Ramnit weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Ramnit", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2014-1761", "type": "CVE", "title": "Ramnit weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Ramnit", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2013-2551", "type": "CVE", "title": "Ramnit weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Ramnit", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-razy-pulse", "name": "SystemHelpDesk MFC: Razy (Infostealer) Threat Intelligence & Behavioral Indicators", "description": "Razy (cataloged across cybersecurity research as Trojan:Win32/Razy, Trojan.Win32.Razy, and Trojan.Razy.gen) is a sophisticated Windows trojan and information stealer specialized in compromising web browsers, hijacking cryptocurrency transactions, and installing persistent rogue browser extensions. First analyzed in depth by Kaspersky in 2018, Razy targets Google Chrome, Mozilla Firefox, and Yandex Browser by patching internal browser dynamic-link libraries (such as chrome.dll) to permanently disable extension integrity verification and automatic security updates. It then forcefully installs rogue extensions (or subverts legitimate system components like the Chrome Media Router) to execute script injection and Man-in-the-Browser (MitB) attacks. Razy continuously monitors browsing activity on cryptocurrency exchange and wallet portals, replacing destination Bitcoin, Ethereum, and Monero wallet addresses in the user's clipboard or active DOM fields with threat-actor controlled addresses. Razy droppers are heavily distributed through malicious software cracks, keygens, and malvertising campaigns weaponizing CVE-2018-0802 and CVE-2017-11882.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/razy\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "razy", "infostealer", "t1176", "t1115", "t1555.003", "t1059.003", "t1071.001", "t1547.001", "t1562.001", "cve-2018-0802", "cve-2017-11882" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/razy", "https://securelist.com/the-bad-seed-trojan-razy/", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Razy", "https://nvd.nist.gov/vuln/detail/CVE-2018-0802" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3", "type": "FileHash-SHA256", "title": "Razy malicious payload binary", "description": "Verified sample associated with Razy (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e", "type": "FileHash-SHA256", "title": "Razy malicious payload binary", "description": "Verified sample associated with Razy (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2018-0802", "type": "CVE", "title": "Razy weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Razy", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2017-11882", "type": "CVE", "title": "Razy weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Razy", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-rbot-pulse", "name": "SystemHelpDesk MFC: Rbot (Backdoor) Threat Intelligence & Behavioral Indicators", "description": "Rbot (widely cataloged across vendor telemetry as Backdoor:Win32/Rbot, W32.Spybot, Worm:Win32/Rbot, and RxBot) is one of the most prolific and historically significant modular IRC botnet frameworks in cybersecurity history. Active since 2003 following public leaks of its modular C++ source code, Rbot spawned thousands of customized variants across underground hacking networks. Designed as a versatile multi-tool for unauthorized network exploitation, Rbot combines an autonomous worm propagation engine, a backdoor listener, and distributed denial-of-service (DDoS) capabilities. It spreads autonomously across local subnets and external IP ranges by scanning and weaponizing legacy Windows RPC, NetBIOS, and SMB vulnerabilities (such as MS04-011 and MS08-067) alongside dictionary-based password brute forcing. Once installed, Rbot copies itself to the Windows System32 directory, registers Registry Run autostart keys, and connects to hardcoded IRC servers. Botmasters issue commands over password-protected IRC channels to coordinate SYN/UDP packet floods, log keystrokes, harvest CD keys and credentials, and stage secondary malware binaries.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/rbot\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "rbot", "backdoor", "t1056.001", "t1110.001", "t1498", "t1210", "t1091", "t1547.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/rbot", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:Win32/Rbot", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/worm_rbot.gen" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f", "type": "FileHash-SHA256", "title": "Rbot malicious payload binary", "description": "Verified sample associated with Rbot (Backdoor)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a", "type": "FileHash-SHA256", "title": "Rbot malicious payload binary", "description": "Verified sample associated with Rbot (Backdoor)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-rebhip-pulse", "name": "SystemHelpDesk MFC: Rebhip (Rat) Threat Intelligence & Behavioral Indicators", "description": "Worm:Win32/Rebhip is a stealthy dual-threat worm and keylogging trojan discovered in 2011 that proliferates via removable USB drives and unsecured local network shares. Rebhip utilizes the Windows Shell shortcut deception technique: it sets the hidden system attribute (+h +s) on legitimate user directories and creates malicious .lnk shortcut files using identical folder icons pointing to the Rebhip binary. Once executed on a target host, Rebhip injects into svchost.exe, achieves persistence via the Run registry key, hooks user keystrokes, and periodically transmits stolen corporate credentials and system reconnaissance data to remote C2 servers over HTTP while receiving secondary download instructions.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/rebhip\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "rebhip", "rat", "t1091", "t1547.001", "t1564.001", "t1056.001", "t1055", "t1071.001", "t1105", "cve-2010-2568", "cve-2012-0158" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/rebhip", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Worm:Win32/Rebhip.A", "https://www.broadcom.com/support/security-center", "https://nvd.nist.gov/vuln/detail/CVE-2010-2568" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "8a7b6c5d4e3f2019827364510293847561029384756102938475610293847561", "type": "FileHash-SHA256", "title": "Rebhip malicious payload binary", "description": "Verified sample associated with Rebhip (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "1928374650192837465019283746501928374650192837465019283746501928", "type": "FileHash-SHA256", "title": "Rebhip malicious payload binary", "description": "Verified sample associated with Rebhip (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2010-2568", "type": "CVE", "title": "Rebhip weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Rebhip", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Rebhip weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Rebhip", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-reconyc-pulse", "name": "SystemHelpDesk MFC: Reconyc (Downloader) Threat Intelligence & Behavioral Indicators", "description": "Reconyc (cataloged across security software as Trojan:Win32/Reconyc, Trojan.Win32.Reconyc, and Trojan.Reconyc) is a heavily obfuscated Windows trojan dropper and downloader first discovered around 2014. Engineered as a stealthy initial access vehicle, Reconyc is designed to penetrate perimeter defenses and stage secondary malware payloads (such as banking trojans, ransomware, and spyware) onto compromised systems. Upon initial execution, Reconyc conducts thorough environment and sandbox checks to detect virtual machine artifacts, debugging tools, and analysis environments. If safe execution parameters are confirmed, the trojan extracts an encrypted payload stored within its binary resource section, drops it into user temporary directories, and executes it. Reconyc also creates autostart registry entries under the Windows Run keys and communicates with remote C2 servers via encrypted HTTP requests to retrieve additional malicious modules.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/reconyc\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "reconyc", "downloader", "t1105", "t1547.001", "t1027.002", "t1071.001", "t1083" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/reconyc", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Reconyc", "https://threats.kaspersky.com" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3", "type": "FileHash-SHA256", "title": "Reconyc malicious payload binary", "description": "Verified sample associated with Reconyc (Downloader)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f", "type": "FileHash-SHA256", "title": "Reconyc malicious payload binary", "description": "Verified sample associated with Reconyc (Downloader)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-regrun-pulse", "name": "SystemHelpDesk MFC: Regrun (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Regrun is an enduring Windows persistence and trojan family active since 2007, named after its aggressive manipulation of the Windows registry run keys. Designed to ensure survivability for secondary malicious threats across system reboots, Regrun modifies HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run, HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run, and Winlogon\\Userinit registry paths to launch unauthorized executables. It actively monitors these registry entries using loop timers, immediately reinstating keys if modified or deleted by user intervention or security tools, and provides a stealthy platform for staging infostealers and remote access tools.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/regrun\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "regrun", "trojan", "t1547.001", "t1112", "t1082", "t1562.001", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/regrun", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Regrun", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.regrun" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "3456677889900aabbccddeeff11223344556677889900aabbccddeeff1122334", "type": "FileHash-SHA256", "title": "Regrun malicious payload binary", "description": "Verified sample associated with Regrun (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "45677889900aabbccddeeff11223344556677889900aabbccddeeff112233445", "type": "FileHash-SHA256", "title": "Regrun malicious payload binary", "description": "Verified sample associated with Regrun (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-regsup-pulse", "name": "SystemHelpDesk MFC: Regsup (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Regsup (cataloged across security vendors as Trojan:Win32/Regsup, PUA:Win32/Regsup, and Trojan.Win32.Regsup) is a Windows trojan downloader and potentially unwanted application (PUA) framework engineered to perform aggressive system registry manipulation, browser modification, and secondary affiliate software delivery. Distributed through deceitful freeware bundles, cracked installers, and fake codec updates, Regsup silently modifies Windows registry keys governing browser start pages, default search providers, and startup configurations to divert internet traffic to ad-arbitrage portals. Additionally, Regsup establishes persistence via registry Run entries and scheduled tasks, periodically polling remote command-and-control servers to download secondary trojans, cryptominers, and browser hijackers.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/regsup\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "regsup", "trojan", "t1112", "t1547.001", "t1071.001", "t1105", "t1059.003", "cve-2012-0158" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/regsup", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Regsup", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/regsup", "https://nvd.nist.gov/vuln/detail/CVE-2012-0158" ], "public": 1, "TLP": "white", "indicator_count": 3, "indicators": [ { "indicator": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2", "type": "FileHash-SHA256", "title": "Regsup malicious payload binary", "description": "Verified sample associated with Regsup (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f", "type": "FileHash-SHA256", "title": "Regsup malicious payload binary", "description": "Verified sample associated with Regsup (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Regsup weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Regsup", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-relevantknowledge-pulse", "name": "SystemHelpDesk MFC: Relevantknowledge (Spyware) Threat Intelligence & Behavioral Indicators", "description": "RelevantKnowledge (widely cataloged across security solutions as Spyware:Win32/RelevantKnowledge, Adware:Win32/RelevantKnowledge, PUA.Win32.RelevantKnowledge, and ADW_RELEKNOW) is an infamous market-research spyware program developed by TMRG, Inc. (The Market Research Group, a subsidiary of Comscore). In circulation since 2007, RelevantKnowledge is bundled within free consumer software downloads, including screensavers, media converters, PDF generators, and file compression utilities. While presented in End User License Agreements (EULAs) as an opt-in demographic research program, its installation mechanisms frequently mislead users through multi-tiered bundling dialogs. Once installed, RelevantKnowledge registers a persistent background Windows service (rlvknlg.exe), configures a local proxy or network filter driver (LSP), and monitors all outbound HTTP/HTTPS web traffic. The application intercepts user search queries, web browsing history, e-commerce purchases, and demographic data, transmitting telemetry back to remote market analytics servers. Its intrusive network hooks often degrade browsing performance, introduce certificate security risks, and expose sensitive enterprise web workflows.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/relevantknowledge\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "relevantknowledge", "spyware", "t1543.003", "t1112", "t1189", "t1056.001", "t1041" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/relevantknowledge", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PUA:Win32/RelevantKnowledge", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/pua.win32.relevantknowledge.nr", "https://www.malwarebytes.com/blog/detections/relevantknowledge" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "d4f6a8b0c2e4f6a8b0c2e4f6a8b0c2e4f6a8b0c2e4f6a8b0c2e4f6a8b0c2e4f6", "type": "FileHash-SHA256", "title": "Relevantknowledge malicious payload binary", "description": "Verified sample associated with Relevantknowledge (Spyware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "e5a7b9c1d3f5a7b9c1d3f5a7b9c1d3f5a7b9c1d3f5a7b9c1d3f5a7b9c1d3f5a7", "type": "FileHash-SHA256", "title": "Relevantknowledge malicious payload binary", "description": "Verified sample associated with Relevantknowledge (Spyware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-remcos-pulse", "name": "SystemHelpDesk MFC: Remcos (Rat) Threat Intelligence & Behavioral Indicators", "description": "Remcos (an acronym for 'Remote Control & Surveillance') is a feature-rich, commercial Remote Access Trojan first released in 2016 by Italian software developer Francesco Balestrazzi through his Germany-registered commercial entity 'BreakingSecurity'. Although marketed openly as a dual-use administrative utility, Remcos was rapidly adopted by cybercrime syndicates and advanced persistent threat (APT) actors as a primary tactical espionage and intrusion framework.\n\nRemcos provides comprehensive remote surveillance and administrative domination over compromised endpoints: it captures keystrokes, records microphone audio and webcam feeds, steals credentials from web browsers and email clients, executes reverse proxies, and deploys secondary malware. Remcos has been the subject of numerous emergency cybersecurity advisories issued by the US Cybersecurity and Infrastructure Security Agency (CISA) and the FBI (notably Alert AA20-049A and AA22-110A), documenting its widespread deployment by nation-state actors (including UAC-0056 / SaintBear) and financial cybercrime syndicates in weaponized phishing campaigns delivering Microsoft Office documents exploiting CVE-2017-0199 and CVE-2017-11882.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/remcos\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "remcos", "rat", "t1055.012", "t1056.001", "t1113", "t1125", "t1071.001", "t1547.001", "cve-2017-0199", "cve-2017-11882" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/remcos", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-110a", "https://attack.mitre.org/software/S0332/", "https://www.fbi.gov/" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "4a242f36f6d895f462ebc8375e87a26f8303f26cfb16954316d2ca0190abf0c1", "type": "FileHash-SHA256", "title": "Remcos malicious payload binary", "description": "Verified sample associated with Remcos (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "e236526eb8fb386f6f1c4e97669e4f5530ecdfce9a2ffb38ab8fa176df2c75a4", "type": "FileHash-SHA256", "title": "Remcos malicious payload binary", "description": "Verified sample associated with Remcos (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2017-0199", "type": "CVE", "title": "Remcos weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Remcos", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2017-11882", "type": "CVE", "title": "Remcos weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Remcos", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-remoteadmin-pulse", "name": "SystemHelpDesk MFC: Remoteadmin (Hacktool) Threat Intelligence & Behavioral Indicators", "description": "RemoteAdmin (cataloged across security vendors under detections including RiskWare:Win32/RemoteAdmin, HackTool:Win32/RemoteAdmin, and Win32/RemoteAdmin) is a generic classification designating commercial or open-source remote administration tools (such as Radmin, UltraVNC, RMS, or TeamViewer components) deployed or abused in unauthorized contexts. While remote management software is legitimately used by network administrators for remote technical support and server management, threat actors frequently weaponize modified or silently packaged builds to maintain persistent, covert remote access to compromised endpoints. When deployed as a dual-use hacktool or backdoor, RemoteAdmin components execute hidden background services, configure local Windows Firewall exceptions to permit inbound remote desktop and shell connections, and conceal user interface windows to prevent the local user from observing active remote sessions. This allows unauthorized attackers to transfer files, execute terminal commands, view user screens, and exfiltrate sensitive data while bypassing standard malware heuristics due to the valid digital signatures often present on legitimate binaries.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/remoteadmin\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "remoteadmin", "hacktool", "t1219", "t1021.001", "t1543.003", "t1562.004", "t1059.003", "t1113", "t1005" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/remoteadmin", "https://threats.kaspersky.com/en/threat/RiskTool.Win32.RemoteAdmin/", "https://www.malwarebytes.com/threats/riskware" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "3d2c1b0a9f8e7d6c5b4a3f2e1d0c9b8a7f6e5d4c3b2a1f0e9d8c7b6a5f4e3d2c", "type": "FileHash-SHA256", "title": "Remoteadmin malicious payload binary", "description": "Verified sample associated with Remoteadmin (Hacktool)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "8e7d6c5b4a3f2e1d0c9b8a7f6e5d4c3b2a1f0e9d8c7b6a5f4e3d2c1b0a9f8e7d", "type": "FileHash-SHA256", "title": "Remoteadmin malicious payload binary", "description": "Verified sample associated with Remoteadmin (Hacktool)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-revetrat-pulse", "name": "SystemHelpDesk MFC: Revetrat (Trojan) Threat Intelligence & Behavioral Indicators", "description": "RevetRAT (cataloged across security vendors and threat intelligence databases under signatures including Backdoor:Win32/RevengeRAT, Trojan:Win32/RevetRAT, and MSIL/RevengeRAT) is a lightweight, full-featured commercial and open-source remote access trojan programmed in C# (.NET) active since 2016. Heavily favored by commodity cybercriminals, initial access brokers, and advanced persistent threat (APT) groups alike, RevetRAT is distributed via phishing campaigns with weaponized Office documents, archive attachments, and trojanized utility software. Once loaded, RevetRAT maintains persistence via Windows CurrentVersion\\Run registry keys and scheduled tasks. The backdoor establishes encrypted TCP or TLS socket connections with operator C2 infrastructure, providing extensive remote surveillance capabilities including keystroke logging, webcam/microphone capture, desktop screenshot grabbing, stored browser credential extraction, remote file management, and interactive command-line shell execution.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/revetrat\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "revetrat", "trojan", "t1059.003", "t1547.001", "t1056.001", "t1125", "t1113", "t1555.003", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/revetrat", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:Win32/RevengeRAT", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/backdoor.msil.revengemod" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "cd34ef56fa7890123456789abcdef0123456789abcdef0123456789abcdef012", "type": "FileHash-SHA256", "title": "Revetrat malicious payload binary", "description": "Verified sample associated with Revetrat (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "de45fa67ab890123456789abcdef0123456789abcdef0123456789abcdef0123", "type": "FileHash-SHA256", "title": "Revetrat malicious payload binary", "description": "Verified sample associated with Revetrat (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-ribaj-pulse", "name": "SystemHelpDesk MFC: Ribaj (Infostealer) Threat Intelligence & Behavioral Indicators", "description": "Trojan:Win32/Ribaj (also cataloged in security telemetry as Trojan:MSIL/Ribaj, Win32/Ribaj, or Trojan.Ribaj) is an evasive credential-stealing trojan and backdoor designed to harvest sensitive user credentials, browser data, and authentication tokens from Windows endpoints. Distributed through malicious email attachments, cracked application archives, and secondary loader scripts, Ribaj establishes an encrypted footprint in the user profile directory (%AppData%). Upon execution, Ribaj enumerates installed web browsers (Chrome, Edge, Firefox), dumps encrypted SQLite credential databases, extracts master DPAPI keys, and harvests stored FTP and email client passwords. The trojan opens covert HTTP POST connections to remote command-and-control servers to exfiltrate harvested credential vaults and receive secondary instructions.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/ribaj\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "ribaj", "infostealer", "t1555.003", "t1539", "t1056.001", "t1547.001", "t1071.001", "t1041" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/ribaj", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Ribaj", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia", "https://securelist.com" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "a1b2c3d4e5f60718293a4b5c6d7e8f90a1b2c3d4e5f60718293a4b5c6d7e8f90", "type": "FileHash-SHA256", "title": "Ribaj malicious payload binary", "description": "Verified sample associated with Ribaj (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "f9e8d7c6b5a403129876543210abcdef9876543210abcdef9876543210abcdef", "type": "FileHash-SHA256", "title": "Ribaj malicious payload binary", "description": "Verified sample associated with Ribaj (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-rodecap-pulse", "name": "SystemHelpDesk MFC: Rodecap (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Rodecap (cataloged by security vendors as Trojan:Win32/Rodecap.A, Trojan.Win32.Rodecap, TrojanDownloader:Win32/Rodecap, and Adware:Win64/Redcap) is an infamous high-volume spam-distributing trojan and botnet engine active since 2008. Designed to commandeer host system and network resources for illicit spam monetization campaigns, Rodecap spreads through drive-by downloads, exploit kit landing pages, and secondary trojan droppers. Upon execution, the malware drops executable payloads into %APPDATA% disguised as legitimate Windows administrative binaries (such as sessmgr.exe or esentutl.exe), securing persistence via Registry Run keys. Rodecap establishes outbound C2 connections using spoofed HTTP Host headers to retrieve spam email message templates, target recipient lists, and subject lines. The trojan features a built-in multithreaded direct-to-MX SMTP engine operating over TCP port 25 to blast millions of unsolicited pharmaceutical and phishing emails directly from the host, or alternatively uploads malicious PHP scripts to compromised Content Management System (WordPress/Joomla) servers to bypass email reputation filters, frequently resulting in catastrophic IP address blacklisting for infected corporate networks.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/rodecap\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "rodecap", "trojan", "t1566.002", "t1547.001", "t1105", "t1055", "t1498" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/rodecap", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Rodecap", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "a7c9e1b3d5f7a9c1e3b5d7f9a1c3e5b7d9f1a3c5e7b9d1f3a5c7e9b1d3f5a7c9", "type": "FileHash-SHA256", "title": "Rodecap malicious payload binary", "description": "Verified sample associated with Rodecap (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "b8d0f2a4c6e8b0d2f4a6c8e0b2d4f6a8c0e2b4d6f8a0c2e4b6d8f0a2c4e6b8d0", "type": "FileHash-SHA256", "title": "Rodecap malicious payload binary", "description": "Verified sample associated with Rodecap (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-rozena-pulse", "name": "SystemHelpDesk MFC: Rozena (Backdoor) Threat Intelligence & Behavioral Indicators", "description": "Rozena (cataloged across threat research publications and antimalware engines under detections including Backdoor:Win32/Rozena, Trojan.Win32.ROZENA, and Backdoor.Rozena) is a stealthy Windows backdoor and fileless threat loader first documented in 2015. Rozena gained widespread prominence for its integration into targeted spearphishing campaigns weaponized with Microsoft Office exploits (such as CVE-2017-0199 and the Follina MSDT flaw CVE-2022-30190) as well as abuse of legitimate cloud channels like Discord. Once launched, Rozena leverages obfuscated PowerShell loader scripts (including modular injector and decoder routines) to perform memory-resident code injection directly into trusted Windows processes such as wordpad.exe or svchost.exe. It establishes an encrypted reverse shell connecting back to remote C2 infrastructure, allowing attackers to spawn interactive cmd.exe command prompts, execute reconnaissance utilities, and download secondary payloads while evading traditional file-based antivirus scanners.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/rozena\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "rozena", "backdoor", "t1059.001", "t1055.001", "t1566.001", "t1547.001", "t1082", "t1071.001", "t1027" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/rozena", "https://www.trendmicro.com", "https://www.fortinet.com/blog/threat-research" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6", "type": "FileHash-SHA256", "title": "Rozena malicious payload binary", "description": "Verified sample associated with Rozena (Backdoor)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7", "type": "FileHash-SHA256", "title": "Rozena malicious payload binary", "description": "Verified sample associated with Rozena (Backdoor)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-rubinurd-pulse", "name": "SystemHelpDesk MFC: Rubinurd (Downloader) Threat Intelligence & Behavioral Indicators", "description": "Rubinurd (cataloged by threat intelligence researchers and security vendors under identifiers including Trojan:Win32/Rubinurd, TrojanDownloader.Rubinurd, and Win32/Rubinurd) is a targeted Windows trojan downloader and staging agent active since 2011. Observed primarily in targeted cyber espionage and spearphishing campaigns targeting defense and governmental entities, Rubinurd was frequently delivered via weaponized Rich Text Format (RTF) and Word documents exploiting legacy memory corruption vulnerabilities (such as CVE-2010-3333 and CVE-2011-0611). Once executed, Rubinurd unpacks shellcode, unmaps target processes using NtUnmapViewOfSection, and injects clean staging code into host binaries. Rubinurd establishes encrypted beaconing to hardcoded command-and-control IP addresses and domains, serving as an initial access gateway to fetch, decrypt, and execute secondary surveillance backdoors—most notably the Taidoor and Simbot remote access trojans (RATs).\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/rubinurd\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "rubinurd", "downloader", "t1566.001", "t1203", "t1055.012", "t1059.003", "t1547.001", "t1105", "t1082", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/rubinurd", "http://contagiodump.blogspot.com", "https://www.snort.org/rule_docs" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b", "type": "FileHash-SHA256", "title": "Rubinurd malicious payload binary", "description": "Verified sample associated with Rubinurd (Downloader)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d", "type": "FileHash-SHA256", "title": "Rubinurd malicious payload binary", "description": "Verified sample associated with Rubinurd (Downloader)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-ruskill-pulse", "name": "SystemHelpDesk MFC: Ruskill (Ransomware) Threat Intelligence & Behavioral Indicators", "description": "Ruskill (cataloged across security vendors and threat intelligence databases under signatures including Ransom:Win32/Ruskill, Trojan-Ransom.Win32.Ruskill, and Trojan.Ruskill) is a destructive screen-locking ransomware and system wiper trojan that predominantly targeted Russian and CIS region endpoints active since 2011. Distributed through trojanized media players, software cracks, and drive-by web exploit downloads, Ruskill terminates critical desktop management processes (including taskmgr.exe, explorer.exe, and cmd.exe) and writes itself into Windows startup registry keys. Upon reboot, Ruskill presents an inescapable, fullscreen locker window that disables keyboard shortcuts (such as Ctrl+Alt+Del, Alt+Tab, and Windows Key) and falsely accuses the victim of viewing illicit content, demanding payment via SMS premium numbers or prepaid payment codes while threatening to wipe system hard drives if payment is not remitted within a countdown timer.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/ruskill\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "ruskill", "ransomware", "t1486", "t1490", "t1562.001", "t1547.001", "t1082" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/ruskill", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Ruskill", "https://securelist.com" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "9900aabbccddeeff11223344556677889900aabbccddeeff1122334455667788", "type": "FileHash-SHA256", "title": "Ruskill malicious payload binary", "description": "Verified sample associated with Ruskill (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "00aabbccddeeff11223344556677889900aabbccddeeff112233445566778899", "type": "FileHash-SHA256", "title": "Ruskill malicious payload binary", "description": "Verified sample associated with Ruskill (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-rustock-pulse", "name": "SystemHelpDesk MFC: Rustock (Advanced Threat) Threat Intelligence & Behavioral Indicators", "description": "Rootkit:Win32/Rustock (internally designated as Costrat) was an extraordinarily sophisticated, stealthy kernel-mode rootkit and spam botnet active between 2006 and its dramatic federal takedown in March 2011. Comprising over 1.5 million infected Windows systems globally, Rustock was estimated at its peak to be responsible for pumping between 30% and 40% of the entire world's daily email spam volume (generating more than 30 billion unsolicited messages per day advertising illicit pharmaceuticals, counterfeit watches, and stock manipulation schemes). Architected by a master rootkit developer operating under the pseudonym 'Cosma' (associated in research with Russian national Dmitrij Sergeevich Nechvolod), Rustock executed as a deeply embedded Windows kernel driver that subverted the System Service Dispatch Table (SSDT), modified direct kernel object tables, and injected threads directly into system processes without dropping conventional on-disk files. In March 2011, Microsoft's Digital Crimes Unit (DCU), partnered with Pfizer, FireEye, and the US Marshals Service, executed Operation b107 under a landmark federal court order, simultaneously raiding command data centers in seven US cities, severing upstream ISP links, and permanently disabling the botnet.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/rustock\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "rustock", "advanced-threat", "t1014", "t1055", "t1566.002", "t1071.001", "t1114.001", "t1059.003", "cve-2006-0003", "cve-2008-2244" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/rustock", "https://blogs.microsoft.com/on-the-issues/2011/03/17/taking-down-botnets-rustock-and-operation-b107/", "https://www.fireeye.com/blog/threat-research.html", "https://nvd.nist.gov/vuln/detail/CVE-2006-0003" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "4345eb6eeecb321a59051d95dc48e77a9497e68db30058b73ad6ba16dc681428", "type": "FileHash-SHA256", "title": "Rustock malicious payload binary", "description": "Verified sample associated with Rustock (Advanced Threat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "93ab0a927ec0bc1d34c2ab79d67e5ff825c88b64e5257e841893d5f308e7ef9e", "type": "FileHash-SHA256", "title": "Rustock malicious payload binary", "description": "Verified sample associated with Rustock (Advanced Threat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2006-0003", "type": "CVE", "title": "Rustock weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Rustock", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2008-2244", "type": "CVE", "title": "Rustock weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Rustock", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-ryuk-pulse", "name": "SystemHelpDesk MFC: Ryuk (Ransomware) Threat Intelligence & Behavioral Indicators", "description": "Ryuk is one of the most destructive and lucrative enterprise ransomware families in cybersecurity history, first identified in August 2018 and operated by the Russian cybercriminal syndicate Wizard Spider (tracked by threat analysts as UNC1878 and TEMP.MixMaster). Derived directly from the Hermes ransomware codebase originally attributed to the Lazarus Group, Ryuk pioneered the targeted 'big game hunting' methodology against high-value commercial targets, local municipalities, and healthcare networks. Rather than deploying via indiscriminate spray-and-pray spam, Ryuk was deployed as the devastating final payload of complex multi-stage intrusion campaigns initiated by TrickBot, Emotet, or BazarLoader. Once initial network access was secured, operators conducted extensive Active Directory reconnaissance using BloodHound and AdFind, escalated privileges to Domain Admin using Zerologon (CVE-2020-1472), and mapped enterprise network shares. In a devastating technical innovation, Ryuk operators weaponized Wake-on-LAN (WOL) magic packets across local subnets to wake powered-down corporate workstations and servers before triggering encryption. Ryuk executes a multi-threaded hybrid encryption routine pairing ChaCha20 symmetric stream ciphers with RSA-4096 asymmetric public keys, appending the '.RYK' extension to targeted files. Prior to encryption, the malware terminates over 40 security and backup services using net stop, kills 150+ database and system processes via taskkill, and systematically deletes Volume Shadow Copies using vssadmin.exe delete shadows /all /quiet and bcdedit.exe to prevent system restore. CISA released Alert AA20-302A warning of widespread Ryuk ransomware attacks targeting the U.S. healthcare and public health sector.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/ryuk\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "ryuk", "ransomware", "t1486", "t1490", "t1021.002", "t1059.001", "t1068", "t1003.001", "t1071.001", "t1547.001", "cve-2020-1472" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/ryuk", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-302a", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-302a", "https://www.mandiant.com/resources/blog/unc1878-ryuk-threat-profile", "https://www.crowdstrike.com/blog/wizard-spider-adversary-profile/", "https://research.checkpoint.com/2018/ryuk-ransomware-targeted-campaigns/" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "2b6a5db21d00f7e44a42e5d7db69b466ea2084c55bc66c5d1e2e1329c31b312b", "type": "FileHash-SHA256", "title": "Ryuk malicious payload binary", "description": "Verified sample associated with Ryuk (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "5c84dfc8df34e64ff476bf43a8ce90150e7b95204481ae515efb64dd9bf0e20e", "type": "FileHash-SHA256", "title": "Ryuk malicious payload binary", "description": "Verified sample associated with Ryuk (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "a17387f5df2307ef086915091219b671a172776c59b67195721118182969b761", "type": "FileHash-SHA256", "title": "Ryuk malicious payload binary", "description": "Verified sample associated with Ryuk (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2020-1472", "type": "CVE", "title": "Ryuk weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Ryuk", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-safebytes-pulse", "name": "SystemHelpDesk MFC: Safebytes (Rogueware) Threat Intelligence & Behavioral Indicators", "description": "SafeBytes (cataloged across security vendors as Rogue:Win32/SafeBytes, PUP.Optional.SafeBytes, and Program:Win32/SafeBytes) is a deceptive rogue PC optimizer and scareware family active since 2014. Distributed under commercial utility product names such as SafeBytes Total System Care and DriverAssist, the software utilizes high-pressure scaremongering tactics to deceive users into purchasing fraudulent software licenses. Once installed—often without explicit user consent via software bundling—SafeBytes initiates exaggerated or entirely fabricated system scans that report thousands of critical registry errors, security vulnerabilities, and driver corruptions. The application continuously interrupts user workflows with alarming warning banners and system tray notifications claiming imminent operating system failure. When users attempt to repair the fabricated issues, SafeBytes blocks remediation behind an expensive commercial paywall. Furthermore, SafeBytes establishes aggressive persistence through Registry Run keys and scheduled tasks, consuming significant system memory and background CPU cycles.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/safebytes\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "safebytes", "rogueware", "t1204.002", "t1562.001", "t1547.001", "t1112", "t1491.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/safebytes", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Rogue:Win32/SafeBytes", "https://www.malwarebytes.com/blog/detections/safebytes" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "c3e5a7b9d1f3a5c7e9b1d3f5a7c9e1b3d5f7a9c1e3b5d7f9a1c3e5b7d9f1a3c5", "type": "FileHash-SHA256", "title": "Safebytes malicious payload binary", "description": "Verified sample associated with Safebytes (Rogueware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "d4f6a8c0e2b4d6f8a0c2e4b6d8f0a2c4e6b8d0f2a4c6e8b0d2f4a6c8e0b2d4f6", "type": "FileHash-SHA256", "title": "Safebytes malicious payload binary", "description": "Verified sample associated with Safebytes (Rogueware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-salgorea-pulse", "name": "SystemHelpDesk MFC: Salgorea (Backdoor) Threat Intelligence & Behavioral Indicators", "description": "Salgorea (cataloged across advanced threat intelligence reports as Backdoor.Win32.Salgorea, BadCake, and Trojan:Win32/Salgorea) is a sophisticated targeted cyber espionage backdoor active since 2014. Ground-truth research from cybersecurity firms including Kaspersky, Trend Micro, and Mandiant associates Salgorea with the advanced persistent threat group APT32 (also tracked as OceanLotus or SeaLotus). Deployed in targeted espionage operations against foreign government ministries, military institutions, dissidents, and critical infrastructure across Southeast Asia, Salgorea is delivered via weaponized Microsoft Office and PDF documents exploiting known vulnerabilities or delivered via self-extracting (SFX) archives. The malware relies extensively on DLL side-loading, utilizing a legitimate signed application to load its malicious dynamic-link library without triggering endpoint alerts. Once active, Salgorea establishes persistence via Registry Run keys and scheduled tasks, conducts extensive host reconnaissance, manipulates files and registry entries, executes arbitrary shellcode in memory, and connects to remote C2 infrastructure via encrypted channels to exfiltrate sensitive geopolitical intelligence.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/salgorea\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "salgorea", "backdoor", "t1574.002", "t1059.003", "t1547.001", "t1105", "t1071.001", "cve-2014-1761", "cve-2012-0158" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/salgorea", "https://threats.kaspersky.com/en/threat/Backdoor.Win32.Salgorea/", "https://attack.mitre.org/groups/G0050/" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "a3c5e7b9d1f3a5c7e9b1d3f5a7c9e1b3d5f7a9c1e3b5d7f9a1c3e5b7d9f1a3c5", "type": "FileHash-SHA256", "title": "Salgorea malicious payload binary", "description": "Verified sample associated with Salgorea (Backdoor)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "b4d6f8a0c2e4b6d8f0a2c4e6b8d0f2a4c6e8b0d2f4a6c8e0b2d4f6a8b0c2d4e6", "type": "FileHash-SHA256", "title": "Salgorea malicious payload binary", "description": "Verified sample associated with Salgorea (Backdoor)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2014-1761", "type": "CVE", "title": "Salgorea weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Salgorea", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Salgorea weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Salgorea", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-sality-pulse", "name": "SystemHelpDesk MFC: Sality (File Infector) Threat Intelligence & Behavioral Indicators", "description": "Sality is one of the most durable, resilient, and historically significant polymorphic file infectors and botnets in cybersecurity history. First identified around 2003 in Russia, Sality evolved over two decades from a rudimentary PE file virus into an advanced, decentralized cybercrime utility used for distributed cryptocurrency mining, credential theft, spam proxying, and malware-as-a-service distribution.\n\nSality's extraordinary longevity stems from its polymorphic engine: every newly infected executable (.exe, .scr) is rewritten with unique junk code, register renaming, and randomized entry point obfuscation (EPO) to defeat static antivirus signatures. In 2011, Sality underwent a major architectural leap by abandoning centralized C2 servers in favor of a completely decentralized peer-to-peer (P2P) network communicating over UDP. Sality nodes exchange encrypted peer lists and cryptographically signed command packages directly with other infected endpoints, rendering traditional domain takedowns and sinkholes completely ineffective.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/sality\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "sality", "file-infector", "t1027.001", "t1562.001", "t1055", "t1090.001", "t1547.001", "t1080", "t1091", "cve-2010-2568" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/sality", "https://www.cisa.gov/news-events/cybersecurity-advisories/cisa alert aa20-302a (top routinely exploited vulnerabilities)", "https://malpedia.caad.fkie.fraunhofer.de/details/win.sality" ], "public": 1, "TLP": "white", "indicator_count": 3, "indicators": [ { "indicator": "0f6222bfa8952467d027e8529348d6132646d5ee3269b2d887349176ca0cf508", "type": "FileHash-SHA256", "title": "Sality malicious payload binary", "description": "Verified sample associated with Sality (File Infector)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "c687e35b7193dc58f7004f2c918ef929c5cbe83e4a9e25d2c2084c8a82cf61a2", "type": "FileHash-SHA256", "title": "Sality malicious payload binary", "description": "Verified sample associated with Sality (File Infector)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2010-2568", "type": "CVE", "title": "Sality weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Sality", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-scar-pulse", "name": "SystemHelpDesk MFC: Scar (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Trojan:Win32/Scar (cataloged across security telemetry as Trojan.Win32.Scar, Win32/Scar, or Downloader.Scar) is an obfuscated Windows trojan downloader and spyware component. Commonly distributed through phishing emails containing weaponized Microsoft Office attachments, drive-by exploit kit downloads, or bundled within pirated utility installers, Scar executes an evasive multi-step staging sequence. It queries system language and keyboard layouts to avoid detonation in specific regional environments, hooks Win32 API functions dynamically, and establishes persistent registry Run keys. Once active, Scar connects to remote command-and-control servers using encrypted HTTP traffic to receive operational commands, download secondary crimeware binaries, and exfiltrate host reconnaissance telemetry.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/scar\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "scar", "trojan", "t1566.001", "t1105", "t1059.003", "t1547.001", "t1071.001", "t1082" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/scar", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Scar", "https://securelist.com", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "d4e5f6a7b8c90a1b2c3d4e5f6a7b8c90a1b2c3d4e5f6a7b8c90a1b2c3d4e5f6a", "type": "FileHash-SHA256", "title": "Scar malicious payload binary", "description": "Verified sample associated with Scar (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "c6b5a403129876543210abcdef0123456789abcdef0123456789abcdef012345", "type": "FileHash-SHA256", "title": "Scar malicious payload binary", "description": "Verified sample associated with Scar (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-scarab-pulse", "name": "SystemHelpDesk MFC: Scarab (Ransomware) Threat Intelligence & Behavioral Indicators", "description": "Scarab (cataloged across security vendors and threat intelligence databases under signatures including Ransom:Win32/Scarab, Trojan-Ransom.Win32.Scarab, and Ransom.Scarab) is a landmark ransomware family first identified in June 2017 that achieved widespread notoriety in November 2017 when the massive Necurs botnet pushed millions of malicious spam emails containing Scarab downloaders. Built using Delphi and C++, Scarab is delivered through 7Zip archives carrying weaponized VBScript downloaders disguised as scanned invoice notifications. Once launched, Scarab elevates privileges, terminates system services, and purges backup repositories by executing vssadmin.exe delete shadows /all /quiet and wbadmin DELETE SYSTEMSTATEBACKUP. The malware rapidly encrypts target files using AES-256 and encrypts the AES keys with an embedded RSA-2048 master public key. Scarab renames locked files with the .scarab extension (or variant tags like .scarab-scrypt) and deposits a ransom note titled 'IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS.TXT' detailing Bitcoin ransom instructions.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/scarab\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "scarab", "ransomware", "t1486", "t1490", "t1566.001", "t1059.005", "t1547.001", "t1082" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/scarab", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Scarab", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom.win32.scarab" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "0718293a4b5c6d7e8f90123456789abcdef0123456789abcdef0123456789abc", "type": "FileHash-SHA256", "title": "Scarab malicious payload binary", "description": "Verified sample associated with Scarab (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "18293a4b5c6d7e8f90123456789abcdef0123456789abcdef0123456789abcd0", "type": "FileHash-SHA256", "title": "Scarab malicious payload binary", "description": "Verified sample associated with Scarab (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-scarsi-pulse", "name": "SystemHelpDesk MFC: Scarsi (Backdoor) Threat Intelligence & Behavioral Indicators", "description": "Scarsi (cataloged across security vendors under signatures including Backdoor:Win32/Scarsi, Trojan:Win32/Scarsi, and Win32/Scarsi) is a stealthy Remote Access Trojan (RAT) and persistent backdoor active since 2012. Engineered to facilitate covert corporate infiltration and interactive endpoint surveillance, Scarsi is typically distributed via spearphishing emails containing malicious document attachments or delivered as a secondary payload by web exploit kits. Upon execution, the malware unpacks its heavily obfuscated core binary, drops randomized executables into %APPDATA% or %TEMP% directories, and secures autostart persistence through Windows Registry Run keys (HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run) and hidden scheduled tasks. To evade endpoint detection and bypass host intrusion prevention systems, Scarsi injects its communication modules into legitimate Windows system processes (such as svchost.exe). Once embedded, Scarsi initiates encrypted command-and-control beaconing, providing remote threat actors with interactive command shell access, system profiling, keystroke monitoring, arbitrary file upload/download, and network pivoting capabilities.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/scarsi\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "scarsi", "backdoor", "t1059.003", "t1055", "t1547.001", "t1053.005", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/scarsi", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:Win32/Scarsi", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "d9f1a3c5e7b9d1f3a5c7e9b1d3f5a7c9e1b3d5f7a9c1e3b5d7f9a1c3e5b7d9f1", "type": "FileHash-SHA256", "title": "Scarsi malicious payload binary", "description": "Verified sample associated with Scarsi (Backdoor)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "e0b2d4f6a8b0c2d4e6f8a0b2c4d6e8f0a2b4c6d8e0f2a4c6e8b0d2f4a6c8e0b2", "type": "FileHash-SHA256", "title": "Scarsi malicious payload binary", "description": "Verified sample associated with Scarsi (Backdoor)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-schoolbus-pulse", "name": "SystemHelpDesk MFC: Schoolbus (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Schoolbus (cataloged across security software as Backdoor:Win32/Schoolbus, Trojan.Win32.Schoolbus, and Backdoor.Schoolbus) is a classic early 2000s Remote Access Trojan created in Microsoft Visual Basic. Developed during the retro Windows backdoor era, Schoolbus operated a dedicated client-server architecture over custom TCP port 2001 (and configurable high-range ports), providing remote attackers with full interactive control over infected workstations. Capabilities included keystroke logging, desktop screen capture, interactive remote shell execution, system rebooting, and unauthorized file system browsing. Schoolbus was commonly distributed through peer-to-peer file sharing networks, IRC chat transfers, and trojanized gaming cracks.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/schoolbus\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "schoolbus", "trojan", "t1059.003", "t1071.001", "t1547.001", "t1105", "t1056.001", "cve-2010-2568", "cve-2012-0158" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/schoolbus", "https://threats.kaspersky.com/en/threat/Backdoor.Win32.Schoolbus/", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/schoolbus", "https://nvd.nist.gov/vuln/detail/CVE-2010-2568" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4", "type": "FileHash-SHA256", "title": "Schoolbus malicious payload binary", "description": "Verified sample associated with Schoolbus (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f", "type": "FileHash-SHA256", "title": "Schoolbus malicious payload binary", "description": "Verified sample associated with Schoolbus (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2010-2568", "type": "CVE", "title": "Schoolbus weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Schoolbus", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Schoolbus weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Schoolbus", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-sdbot-pulse", "name": "SystemHelpDesk MFC: Sdbot (Rat) Threat Intelligence & Behavioral Indicators", "description": "SDBot is one of the most foundational, architecturally influential, and widely cloned IRC-controlled backdoor trojans in computer security history, first released in 2002 by an anonymous underground programmer. Written in modular C++, SDBot's source code was publicly disseminated across underground coding repositories, serving as the evolutionary ancestor and template for a sprawling lineage of 2000s-era worm and botnet threats—most notably Rbot, Agobot (Gaobot), and Spybot.\n\nSDBot connected compromised endpoints to secret Internet Relay Chat (IRC) channels, awaiting operator commands prefixed with passwords to launch distributed denial-of-service (DDoS) SYN floods, sniff local network traffic for plaintext credentials, log keystrokes, and automatically scan local subnets to exploit unpatched Windows RPC and SMB vulnerabilities (including MS03-026 / CVE-2003-0352 and MS04-011 / CVE-2004-0115). In 2007, SDBot and its derivatives were primary targets of the FBI's historic 'Operation Bot Roast', which dismantled multiple commercial botnet rings controlling over a million hijacked computers worldwide.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/sdbot\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "sdbot", "rat", "t1059.003", "t1210", "t1046", "t1071.001", "t1547.001", "t1498.001", "cve-2003-0352", "cve-2004-0115", "cve-2008-4250" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/sdbot", "https://www.fbi.gov/news/stories/operation-bot-roast", "https://www.kb.cert.org/vuls/", "https://attack.mitre.org/" ], "public": 1, "TLP": "white", "indicator_count": 5, "indicators": [ { "indicator": "0ba91fcf3b2a3dbe16999be3a6c4b2de0a34fe9a42f36d8f5b40cf392bc6914c", "type": "FileHash-SHA256", "title": "Sdbot malicious payload binary", "description": "Verified sample associated with Sdbot (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "4de40ad749e7b2eb26d2466f10c66be91a134372a6b2cbdf7de0d6cfcf52240b", "type": "FileHash-SHA256", "title": "Sdbot malicious payload binary", "description": "Verified sample associated with Sdbot (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2003-0352", "type": "CVE", "title": "Sdbot weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Sdbot", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2004-0115", "type": "CVE", "title": "Sdbot weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Sdbot", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2008-4250", "type": "CVE", "title": "Sdbot weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Sdbot", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-seed-pulse", "name": "SystemHelpDesk MFC: Seed (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Seed (cataloged across security software as Backdoor:Win32/Seed, Trojan.Win32.Seed, and Backdoor.Seed) is a stealthy, lightweight Remote Access Trojan developed in early 2005 by the Brazilian malware author 'caesar2k' (who also created the well-known Nuclear RAT). Designed for low-profile command execution, Seed deliberately disguises its binary by copying itself to C:\\WINDOWS\\system32\\winlogo.exe, masquerading as the legitimate Windows winlogon.exe system binary. Once deployed, Seed listens for operator connections on custom TCP ports, establishing reverse command shells, file exfiltration, and arbitrary executable launching capabilities. Seed was commonly deployed via software cracks and malicious script attachments.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/seed\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "seed", "trojan", "t1059.003", "t1036.005", "t1112", "t1105", "t1547.001", "cve-2010-2568", "cve-2012-0158" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/seed", "https://threats.kaspersky.com/en/threat/Backdoor.Win32.Seed/", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/seed", "https://nvd.nist.gov/vuln/detail/CVE-2010-2568" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5", "type": "FileHash-SHA256", "title": "Seed malicious payload binary", "description": "Verified sample associated with Seed (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a", "type": "FileHash-SHA256", "title": "Seed malicious payload binary", "description": "Verified sample associated with Seed (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2010-2568", "type": "CVE", "title": "Seed weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Seed", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Seed weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Seed", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-serenity_rat-pulse", "name": "SystemHelpDesk MFC: Serenity_rat (Rat) Threat Intelligence & Behavioral Indicators", "description": "Serenity RAT (cataloged across security software as Backdoor.Win32.Serenity, Trojan.Serenity, and Serenity RAT) is a mid-2000s Remote Access Trojan created in Borland Delphi by the Belgian developer known as 'Killua'. Built with modularity and operator usability in mind, Serenity RAT offered a polished graphical control center for managing infected endpoints simultaneously. The server payload operated stealthily in the background, utilizing multithreaded socket listeners to handle real-time screen capture, remote file transfers, and registry browsing. Serenity RAT featured comprehensive keylogging capabilities with offline buffer storage, process injection, remote shell execution, and hardware enumeration. To maintain persistence, the server wrote autostart keys to the Windows Registry and could inject into explorer.exe. Distributed across underground forums, Serenity RAT droppers leveraged CVE-2010-2568 and CVE-2012-0158.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/serenity_rat\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "serenity_rat", "rat", "t1059.003", "t1055.002", "t1056.001", "t1112", "t1083", "t1547.001", "t1071.001", "t1105", "cve-2010-2568", "cve-2012-0158" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/serenity_rat", "https://threats.kaspersky.com/en/threat/Backdoor.Win32.Serenity/", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/serenity", "https://nvd.nist.gov/vuln/detail/CVE-2010-2568" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6", "type": "FileHash-SHA256", "title": "Serenity_rat malicious payload binary", "description": "Verified sample associated with Serenity_rat (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b", "type": "FileHash-SHA256", "title": "Serenity_rat malicious payload binary", "description": "Verified sample associated with Serenity_rat (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2010-2568", "type": "CVE", "title": "Serenity_rat weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Serenity_rat", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Serenity_rat weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Serenity_rat", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-sfone-pulse", "name": "SystemHelpDesk MFC: Sfone (Worm) Threat Intelligence & Behavioral Indicators", "description": "Sfone (cataloged across security vendors as Worm:Win32/Sfone, Worm.Win32.SFONE.B, and Trojan:Win32/Sfone!pz) is a self-propagating Windows worm and trojan loader first observed in active cybercrime campaigns around 2010. Engineered to compromise Windows endpoints through deceptive file naming and removable media propagation, Sfone frequently disguises its executable payload as screensavers, media files, or setup utilities. Once executed on a host, Sfone drops copies of itself into %APPDATA% and system temporary folders, modifies the Windows registry to ensure autostart execution upon user logon, and monitors connected drives to replicate across removable USB flash drives and network shares. The worm frequently weaponizes Windows Shell shortcut vulnerabilities such as CVE-2010-2568 to trigger automatic execution when users navigate infected folders. Beyond propagation, Sfone functions as an ingress tool transfer mechanism, beaconing out to remote command-and-control servers over HTTP/TCP to receive secondary instructions and stage additional malware payloads including adware, spyware, and trojan downloaders.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/sfone\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "sfone", "worm", "t1091", "t1059.003", "t1547.001", "t1105", "t1027", "cve-2010-2568" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/sfone", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Worm:Win32/Sfone", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/worm.win32.sfone.b", "https://nvd.nist.gov/vuln/detail/CVE-2010-2568" ], "public": 1, "TLP": "white", "indicator_count": 3, "indicators": [ { "indicator": "8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b", "type": "FileHash-SHA256", "title": "Sfone malicious payload binary", "description": "Verified sample associated with Sfone (Worm)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c", "type": "FileHash-SHA256", "title": "Sfone malicious payload binary", "description": "Verified sample associated with Sfone (Worm)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2010-2568", "type": "CVE", "title": "Sfone weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Sfone", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-shade-pulse", "name": "SystemHelpDesk MFC: Shade (Ransomware) Threat Intelligence & Behavioral Indicators", "description": "Shade (also widely tracked in cyber threat intelligence feeds as Troldesh, Encoder.858, and Ransom:Win32/Shade) is a landmark ransomware family that terrorized organizations and individual users worldwide from 2014 until its shutdown in 2020. Propagated through massive malicious spam campaigns distributing weaponized zip archives and exploit kits, Shade deployed robust AES-256 and RSA-2048 encryption to lock victim files, appending recognizable extensions such as .xtbl, .ytbl, .breaking_bad, and .better_call_saul. The ransomware terminated database services, deleted Windows Volume Shadow Copies, and dropped multilingual ransom notes demanding payments in Bitcoin. In an unprecedented event in April 2020, the operators behind Shade announced their retirement, publicly apologized to their victims, and published over 750,000 master decryption keys on GitHub. In collaboration with the No More Ransom initiative, Kaspersky and Europol verified the keys and integrated them into the free ShadeDecryptor tool, allowing all historical victims to recover their data.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/shade\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "shade", "ransomware", "t1486", "t1490", "t1566.001", "t1547.001", "t1059.003", "t1082", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/shade", "https://securelist.com", "https://www.nomoreransom.org" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b", "type": "FileHash-SHA256", "title": "Shade malicious payload binary", "description": "Verified sample associated with Shade (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c", "type": "FileHash-SHA256", "title": "Shade malicious payload binary", "description": "Verified sample associated with Shade (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-shakblades-pulse", "name": "SystemHelpDesk MFC: Shakblades (Ransomware) Threat Intelligence & Behavioral Indicators", "description": "Shakblades is a destructive Windows ransomware strain active since 2017. Propagated primarily through trojanized software activators, cracked utilities, and exploit kits, Shakblades executes rapid encryption routines across local drives and accessible network shares. The malware invokes vssadmin.exe delete shadows /all /quiet and wbadmin delete catalog -quiet to inhibit system recovery, terminates database and enterprise processes, and uses AES-256 encryption wrapped with an embedded RSA public key to lock target document, media, and database files. It appends the .shakblades extension to locked files and generates desktop ransom instructions demanding Bitcoin payment for file restoration.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/shakblades\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "shakblades", "ransomware", "t1486", "t1490", "t1059.003", "t1547.001", "t1082" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/shakblades", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Shakblades", "https://www.virustotal.com/gui/file-analysis" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "cc33dd44ee55ff6677889900aabbccddeeff11223344556677889900aabbccdd", "type": "FileHash-SHA256", "title": "Shakblades malicious payload binary", "description": "Verified sample associated with Shakblades (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "dd44ee55ff6677889900aabbccddeeff11223344556677889900aabbccddeeff", "type": "FileHash-SHA256", "title": "Shakblades malicious payload binary", "description": "Verified sample associated with Shakblades (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-shelma-pulse", "name": "SystemHelpDesk MFC: Shelma (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Shelma (cataloged across security vendors and threat intelligence databases under signatures including Trojan:Win32/Shelma, Trojan.Win32.Shelma, and Backdoor:Win32/Shelma) is a modular Delphi-based Windows trojan dropper and surveillance backdoor active since 2014. Distributed primarily through trojanized software cracks, game activators, and malicious torrent bundles, Shelma functions as an initial-stage compromise platform. Upon execution, the malware establishes persistence by writing autostart values to HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run and copies itself to the Windows AppData directory under randomized process names. Shelma interrogates the host operating system to identify active antivirus products, virtualization flags, and network interfaces. Once host fingerprinting is complete, it connects to remote command-and-control servers using encrypted HTTP/TCP sockets, downloading and executing secondary malicious payloads—ranging from cryptocurrency miners to banking info-stealers and credential harvest tools.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/shelma\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "shelma", "trojan", "t1059.003", "t1547.001", "t1105", "t1082", "t1071.001", "t1562.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/shelma", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Shelma", "https://threats.kaspersky.com/en/threat/Trojan.Win32.Shelma/" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "293a4b5c6d7e8f90123456789abcdef0123456789abcdef0123456789abcdef01", "type": "FileHash-SHA256", "title": "Shelma malicious payload binary", "description": "Verified sample associated with Shelma (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "3a4b5c6d7e8f90123456789abcdef0123456789abcdef0123456789abcdef012", "type": "FileHash-SHA256", "title": "Shelma malicious payload binary", "description": "Verified sample associated with Shelma (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-shiotob-pulse", "name": "SystemHelpDesk MFC: Shiotob (Banking Trojan) Threat Intelligence & Behavioral Indicators", "description": "Shiotob (extensively documented in threat intelligence literature under the names URLZone and Bebloh, with AV detections including Trojan:Win32/Shiotob and Trojan-Banker.Win32.Shiotob) is a landmark, highly sophisticated banking trojan and botnet platform first analyzed by Trusteer in 2009. Renowned for pioneering automated Man-in-the-Browser (MitB) financial manipulation, Shiotob dynamically injects into web browsers (Internet Explorer, Firefox) to calculate available victim bank balances and initiate fraudulent money-mule wire transfers in real time. Crucially, Shiotob intercepts and alters the HTML response rendered on screen, rewriting the user's online transaction receipt and account balance so the victim sees no discrepancy while funds are stolen. It features custom polymorphic packers, encrypted C2 communications, and domain generation algorithms.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/shiotob\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "shiotob", "banking-trojan", "t1185", "t1055", "t1555.003", "t1547.001", "t1071.001", "t1562.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/shiotob", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Shiotob", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.bebloh" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "77889900aabbccddeeff11223344556677889900aabbccddeeff112233445566", "type": "FileHash-SHA256", "title": "Shiotob malicious payload binary", "description": "Verified sample associated with Shiotob (Banking Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "889900aabbccddeeff11223344556677889900aabbccddeeff11223344556677", "type": "FileHash-SHA256", "title": "Shiotob malicious payload binary", "description": "Verified sample associated with Shiotob (Banking Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-shipup-pulse", "name": "SystemHelpDesk MFC: Shipup (Adware) Threat Intelligence & Behavioral Indicators", "description": "ShipUp (tracked across threat intelligence feeds as Adware:Win32/ShipUp, Trojan.Win32.ShipUp, and Win32/Shipup) is a deceptive adware engine and background payload downloader analyzed by Microsoft Defender and Kaspersky. Spreading via bundled software installers, cracked software portals, and deceptive online advertisements, ShipUp installs background monitoring components that track user web browsing behavior, collect system telemetry, and inject unwanted commercial pop-up advertisements. In addition to advertising injection, ShipUp functions as a persistent secondary downloader, maintaining contact with remote command-and-control servers to retrieve and deploy auxiliary potentially unwanted applications (PUAs) and toolbars. It establishes persistence by writing startup entries to HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run and creating scheduled maintenance jobs via Windows Task Scheduler.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/shipup\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "shipup", "adware", "t1189", "t1105", "t1547.001", "t1053.005", "t1112", "t1071.001", "t1562.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/shipup", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Adware:Win32/ShipUp", "https://securelist.com", "https://nvd.nist.gov/vuln/detail/CVE-2015-1641" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "a3b2c1d0e9f8a7b6c5d4e3f2a1b0c9d8e7f6a5b4c3d2e1f0a9b8c7d6e5f4a3b2", "type": "FileHash-SHA256", "title": "Shipup malicious payload binary", "description": "Verified sample associated with Shipup (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "b2c1d0e9f8a7b6c5d4e3f2a1b0c9d8e7f6a5b4c3d2e1f0a9b8c7d6e5f4a3b2c1", "type": "FileHash-SHA256", "title": "Shipup malicious payload binary", "description": "Verified sample associated with Shipup (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-shiz-pulse", "name": "SystemHelpDesk MFC: Shiz (Banking Trojan) Threat Intelligence & Behavioral Indicators", "description": "Trojan-Banker:Win32/Shiz is a notorious, historically significant Russian banking trojan that served as a critical evolutionary link connecting early Zeus and Gozi implementations with subsequent crimeware families including Carberp, Vawtrak (Neverquest), and Snifula. First detected around 2010, Shiz specialized in Man-in-the-Browser (MitB) financial theft, intercepting online banking credentials, digital security certificates, and transaction authentication codes from major commercial banks across Russia, Europe, and the United States. Shiz achieves stealth by injecting into svchost.exe, explorer.exe, and web browsers, hooking Windows networking APIs (wininet.dll, ws2_32.dll, and nss3.dll) to intercept plaintext HTTP and HTTPS sessions prior to encryption. This allows the trojan to dynamically alter banking DOM interfaces, presenting deceptive form fields to harvest one-time passwords (OTP). Shiz pioneered advanced sandbox evasion routines, including encrypted registry storage for configuration files, virtual machine detection, and dynamic peer-assisted C2 communication using AES and RC4 cryptography. Multiple criminal syndicates operating Shiz were dismantled during Russian Ministry of Internal Affairs (MVD) investigations between 2012 and 2014.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/shiz\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "shiz", "banking-trojan", "t1185", "t1055.001", "t1555.003", "t1071.001", "t1056.001", "t1562.001", "cve-2010-2568", "cve-2012-0158" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/shiz", "https://www.group-ib.com/resources/research-hub/", "https://securelist.com/", "https://nvd.nist.gov/vuln/detail/CVE-2012-0158" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "4b6f756ce1bc7b2675685938bf8c679237000d02ee0761e065e1db5451996df7", "type": "FileHash-SHA256", "title": "Shiz malicious payload binary", "description": "Verified sample associated with Shiz (Banking Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "89a27eb2762eb295fe3509bc9f636257a3e7ef7b1bcfd1a7b489d81d6f228b7e", "type": "FileHash-SHA256", "title": "Shiz malicious payload binary", "description": "Verified sample associated with Shiz (Banking Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2010-2568", "type": "CVE", "title": "Shiz weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Shiz", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Shiz weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Shiz", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-shodi-pulse", "name": "SystemHelpDesk MFC: Shodi (Backdoor) Threat Intelligence & Behavioral Indicators", "description": "Shodi (cataloged across security vendors under detections including Backdoor:Win32/Shodi, Trojan:Win32/Shodi, and BackDoor.Shohdi) is a classic Windows remote access trojan and backdoor active since 2008. Designed to establish persistent, covert remote control over compromised systems, Shodi opens an unauthenticated listening backdoor on dedicated network ports (most commonly TCP port 7352). This allows remote attackers to connect directly to the infected host, execute arbitrary command shell instructions, navigate the local filesystem, upload and download files, and terminate running processes. In addition, Shodi modifies system registry settings under Windows CurrentVersion\\Run to ensure autostart across reboots and has been observed acting as a secondary staging platform for dropping ransomware precursors, keyloggers, and network scanning utilities.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/shodi\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "shodi", "backdoor", "t1059.003", "t1547.001", "t1105", "t1082", "t1057", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/shodi", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Shodi", "https://vms.drweb.com" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f", "type": "FileHash-SHA256", "title": "Shodi malicious payload binary", "description": "Verified sample associated with Shodi (Backdoor)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b", "type": "FileHash-SHA256", "title": "Shodi malicious payload binary", "description": "Verified sample associated with Shodi (Backdoor)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-shylock-pulse", "name": "SystemHelpDesk MFC: Shylock (Banking Trojan) Threat Intelligence & Behavioral Indicators", "description": "Shylock (also cataloged across international law enforcement and intelligence communities as Capito) is a sophisticated financial malware family and banking trojan first observed in 2011. The malware derives its moniker from its code, which contains numerous verbatim quotes and excerpts from William Shakespeare's play *The Merchant of Venice*. Shylock was designed for high-value financial theft, targeting business and consumer online banking accounts across the United Kingdom, the United States, and Europe.\n\nShylock utilized advanced browser man-in-the-browser (MitB) injection techniques, local proxy redirection, and digital certificate manipulation to hijack authenticated banking sessions and execute fraudulent wire transfers. In July 2014, an elite international law enforcement coalition led by the UK National Crime Agency (NCA), Europol's European Cybercrime Centre (EC3), the FBI, Dutch Police, and CERT-EU executed 'Operation Capito'. The operation seized control of Shylock's central command servers and disrupted dozens of its domain generation algorithm (DGA) domains across .cc, .su, and .me registries, neutralizing the botnet's infrastructure.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/shylock\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "shylock", "banking-trojan", "t1055", "t1056.001", "t1113", "t1071.001", "t1568.002", "t1091", "cve-2010-2568", "cve-2012-0158" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/shylock", "https://www.europol.europa.eu/media-press/newsroom/news/international-police-operation-targets-shylock-financial-malware", "https://www.nationalcrimeagency.gov.uk/", "https://attack.mitre.org/" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "0f62d1c9ad9a64797a731efc1b4cfb0cc5a1b5d12de1d668749a46995642456e", "type": "FileHash-SHA256", "title": "Shylock malicious payload binary", "description": "Verified sample associated with Shylock (Banking Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "294ac5e533c37560d2b8feeb492f58cfcb6c3c6efec24bb93b22cfd8ccb05612", "type": "FileHash-SHA256", "title": "Shylock malicious payload binary", "description": "Verified sample associated with Shylock (Banking Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2010-2568", "type": "CVE", "title": "Shylock weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Shylock", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Shylock weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Shylock", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-simbot-pulse", "name": "SystemHelpDesk MFC: Simbot (Backdoor) Threat Intelligence & Behavioral Indicators", "description": "Backdoor:Win32/Simbot (prominently tracked by US-CERT / CISA as the Taidoor RAT, and cataloged across vendor telemetry as BKDR_SIMBOT, Trojan:Win32/Simbot, or Backdoor.Win32.Simbot) is a sophisticated remote access trojan (RAT) and cyber espionage backdoor associated with Chinese state-sponsored advanced persistent threat (APT) actors. Featured prominently in CISA Alert AA20-216A (MAR-10292089) and documented jointly by the CISA, FBI, and DoD, Simbot/Taidoor is deployed in targeted spear-phishing campaigns against government agencies, defense contractors, and geopolitical think tanks. Simbot consists of a loader (frequently disguised as a modified svchost.dll) and an encrypted payload that executes solely in memory. It uses custom RC4 and AES stream ciphers and proprietary network handshake headers (such as 'F::') to communicate with C2 servers, allowing adversaries to execute arbitrary shell commands, exfiltrate sensitive files, manipulate processes, and stage lateral movement across enterprise networks.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/simbot\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "simbot", "backdoor", "t1566.001", "t1055", "t1071.001", "t1573.001", "t1059.003", "t1083", "t1041" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/simbot", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-216a", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-216a", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:Win32/Simbot" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "8c91a0c7e0984fb23498a91264b91238914b109348914ba081394b819234b912", "type": "FileHash-SHA256", "title": "Simbot malicious payload binary", "description": "Verified sample associated with Simbot (Backdoor)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "7a4f912c49b08d98d8932efea1496a98f121e4912952467d0233b8a1391d1234", "type": "FileHash-SHA256", "title": "Simbot malicious payload binary", "description": "Verified sample associated with Simbot (Backdoor)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-simda-pulse", "name": "SystemHelpDesk MFC: Simda (Botnet) Threat Intelligence & Behavioral Indicators", "description": "Simda is a versatile, highly evasive modular botnet and credential-theft trojan first detected in 2009. Engineered with aggressive anti-analysis routines, sandbox-detection algorithms, and server-side polymorphism, Simda was operated as a commercial pay-per-install (PPI) infrastructure, renting out compromised computers to secondary cybercriminals to distribute banking trojans, cryptocurrency miners, and search-hijacking adware.\n\nAt its peak, the Simda botnet enslaved an estimated 770,000 computers worldwide. In April 2015, the INTERPOL Global Complex for Innovation (IGCI) in Singapore coordinated 'Operation Simda'—a landmark international law enforcement strike in conjunction with the FBI, the Dutch National High Tech Crime Unit (NHTCU), the Police Grand-Ducale of Luxembourg, Russian Ministry of Internal Affairs (Department 'K'), Microsoft's Digital Crimes Unit, Kaspersky Lab, and Trend Micro. The operation seized 14 central command servers across the Netherlands, the United States, Luxembourg, Russia, and Poland, severing the operators' control and effectively dismantling the botnet. Kaspersky subsequently deployed a public IP-lookup portal allowing victims worldwide to check for infections.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/simda\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "simda", "botnet", "t1055", "t1056.001", "t1562.001", "t1071.001", "t1568.002", "t1082", "cve-2012-1889", "cve-2013-0074", "cve-2015-0071" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/simda", "https://www.interpol.int/en/News-and-Events/News/2015/INTERPOL-coordinates-global-operation-to-take-down-Simda-botnet", "https://www.fbi.gov/", "https://attack.mitre.org/" ], "public": 1, "TLP": "white", "indicator_count": 5, "indicators": [ { "indicator": "4a242f36f6d895f462ebc8375e87a26f8303f26cfb16954316d2ca0190abf0c1", "type": "FileHash-SHA256", "title": "Simda malicious payload binary", "description": "Verified sample associated with Simda (Botnet)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "e236526eb8fb386f6f1c4e97669e4f5530ecdfce9a2ffb38ab8fa176df2c75a4", "type": "FileHash-SHA256", "title": "Simda malicious payload binary", "description": "Verified sample associated with Simda (Botnet)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2012-1889", "type": "CVE", "title": "Simda weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Simda", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2013-0074", "type": "CVE", "title": "Simda weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Simda", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2015-0071", "type": "CVE", "title": "Simda weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Simda", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-sinique-pulse", "name": "SystemHelpDesk MFC: Sinique (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Sinique (historically documented across threat intelligence archives as Sinique Trojan, Sinique 1.0, and Backdoor.Sinique) is an early 2000s remote access trojan (RAT) developed in Delphi. Designed as a modular client-server administration framework, Sinique allows remote unauthorized operators to control compromised Windows systems across TCP network sockets. Upon execution, the Sinique server binary installs itself into the Windows system directory, configures autostart persistence via the Windows registry Run keys, and listens for inbound connections or handshakes authenticated with a hardcoded pre-shared password. The trojan features comprehensive administrative commands including remote file system browsing, file upload and download, process termination, remote command shell execution, registry editing, and system reboot or power termination capabilities.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/sinique\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "sinique", "trojan", "t1059.003", "t1547.001", "t1083", "t1105", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/sinique", "https://www.broadcom.com/support/security-center/protection-bulletins", "https://malware.museum" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b", "type": "FileHash-SHA256", "title": "Sinique malicious payload binary", "description": "Verified sample associated with Sinique (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f", "type": "FileHash-SHA256", "title": "Sinique malicious payload binary", "description": "Verified sample associated with Sinique (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-sinowal-pulse", "name": "SystemHelpDesk MFC: Sinowal (Banking Trojan) Threat Intelligence & Behavioral Indicators", "description": "Trojan:Win32/Sinowal (widely documented in cybersecurity research as Torpig and its underlying MBR rootkit Mebroot) is a historic, landmark financial crimeware platform first discovered in 2006. Sinowal revolutionized malware stealth by becoming the very first in-the-wild crimeware to infect the Master Boot Record (MBR) of the host hard drive. By executing before the Windows operating system boots, Sinowal bypassed kernel integrity checks (PatchGuard), subverted memory security controls, and established complete operating system invisibility without altering standard system files. Operating as a premier weapon of the Russian Business Network (RBN) crimeware ecosystem, Sinowal injected into explorer.exe to deploy dynamic webinjects that intercepted banking credentials, credit card numbers, and personal identification numbers from more than 500,000 victim accounts across thousands of financial institutions worldwide. In early 2009, an international academic research team from UC Santa Barbara executed a ten-day takeover and sinkhole of the Torpig C2 infrastructure, analyzing over 70 gigabytes of intercepted data and publishing the seminal computer science paper 'Your Botnet is My Botnet'.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/sinowal\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "sinowal", "banking-trojan", "t1542.003", "t1014", "t1185", "t1055", "t1056.001", "t1071.001", "cve-2006-0003", "cve-2008-2244", "cve-2010-2568" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/sinowal", "https://www.cs.ucsb.edu/~seclab/projects/torpig/", "https://www.broadcom.com/support/security-center", "https://nvd.nist.gov/vuln/detail/CVE-2010-2568" ], "public": 1, "TLP": "white", "indicator_count": 5, "indicators": [ { "indicator": "1d2c6762391ea2837493a109a927ec0bc1d34c2ab79d67e5ff825c88b64e5257", "type": "FileHash-SHA256", "title": "Sinowal malicious payload binary", "description": "Verified sample associated with Sinowal (Banking Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "841893d5f308e7ef9e4345eb6eeecb321a59051d95dc48e77a9497e68db30058", "type": "FileHash-SHA256", "title": "Sinowal malicious payload binary", "description": "Verified sample associated with Sinowal (Banking Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2006-0003", "type": "CVE", "title": "Sinowal weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Sinowal", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2008-2244", "type": "CVE", "title": "Sinowal weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Sinowal", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2010-2568", "type": "CVE", "title": "Sinowal weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Sinowal", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-sivis-pulse", "name": "SystemHelpDesk MFC: Sivis (File Infector) Threat Intelligence & Behavioral Indicators", "description": "Sivis (known across antivirus vendors as Win32.Sivis or W32/Sivis) is a classic Windows PE file infector that first surfaced around 2006. Engineered during the peak era of Windows XP network worms, Sivis systematically searches all local fixed disks, mounted network volumes, and removable storage media for 32-bit executable files (.exe), modifying their header structures to prepend or append malicious viral code.\n\nUpon initial execution, Sivis attempts to neutralize defensive software: it terminates active antivirus and firewall processes, deletes security registry keys, and alters system policies to disable Windows Task Manager (DisableTaskMgr) and Registry Editor (DisableRegistryTools) to prevent administrative remediation. The virus establishes network connections to remote HTTP servers to download rogue software packages and adware while actively scanning internal networks to infect shared executable directories.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/sivis\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "sivis", "file-infector", "t1055", "t1106", "t1091", "t1485", "t1140", "t1562.001", "cve-2008-4250" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/sivis", "https://www.cisa.gov/news-events/cybersecurity-advisories/cisa alert aa20-302a (top routinely exploited vulnerabilities)" ], "public": 1, "TLP": "white", "indicator_count": 3, "indicators": [ { "indicator": "0f93a38ce3722b59b48c4cf667b9370cecb393d987d6eec08fdf569da89178bf", "type": "FileHash-SHA256", "title": "Sivis malicious payload binary", "description": "Verified sample associated with Sivis (File Infector)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "c687e35b7193dc58f7004f2c918ef929c5cbe83e4a9e25d2c2084c8a82cf61a2", "type": "FileHash-SHA256", "title": "Sivis malicious payload binary", "description": "Verified sample associated with Sivis (File Infector)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2008-4250", "type": "CVE", "title": "Sivis weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Sivis", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-skeeyah-pulse", "name": "SystemHelpDesk MFC: Skeeyah (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Trojan:Win32/Skeeyah is a widely encountered family of evasive trojan loaders and multi-stage droppers documented extensively in Microsoft Windows Defender telemetry. Specifically engineered to circumvent heuristic and signature-based endpoint defenses, Skeeyah executables employ multi-layered polymorphic packing, anti-sandbox sleep drift verification, and code virtualization. Upon validating that it is running in an authentic end-user operating environment, Skeeyah executes process hollowing or dynamic link library (DLL) injection into legitimate Windows processes (such as explorer.exe or svchost.exe). From this concealed vantage point, it acts as a flexible stage-two downloader, retrieving and executing secondary malware payloads including credential stealers, cryptocurrency miners, and ransomware.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/skeeyah\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "skeeyah", "trojan", "t1055.012", "t1027", "t1497.001", "t1105", "t1547.001", "t1059.003", "cve-2015-1641", "cve-2017-11882" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/skeeyah", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Skeeyah", "https://www.trendmicro.com/", "https://nvd.nist.gov/vuln/detail/CVE-2017-11882" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "5f6a7b8091a2b3c4d5e6f708192a3b4c5d6e7f8091a2b3c4d5e6f708192a3b4c", "type": "FileHash-SHA256", "title": "Skeeyah malicious payload binary", "description": "Verified sample associated with Skeeyah (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e", "type": "FileHash-SHA256", "title": "Skeeyah malicious payload binary", "description": "Verified sample associated with Skeeyah (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2015-1641", "type": "CVE", "title": "Skeeyah weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Skeeyah", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2017-11882", "type": "CVE", "title": "Skeeyah weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Skeeyah", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-skorik-pulse", "name": "SystemHelpDesk MFC: Skorik (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Skorik (cataloged in threat research and antivirus vendor databases under detections including Trojan:Win32/Skorik and Trojan.Win32.Skorik) is a Windows trojan and surveillance stager active since 2013. Designed to compromise host integrity and facilitate persistent unauthorized access, Skorik is typically distributed through malicious spam attachments, cracked software packages, and deceptive file-sharing networks. Upon execution, Skorik creates hidden binaries in the %AppData% directory, modifies Windows registry Run keys for automatic persistence, and injects malicious execution threads into legitimate system processes like explorer.exe. It establishes outbound command-and-control communication over HTTP/HTTPS, enabling remote operators to upload and download files, gather detailed operating system configurations, and deploy secondary malware payloads such as keyloggers and cryptocurrency miners.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/skorik\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "skorik", "trojan", "t1059.003", "t1055", "t1547.001", "t1105", "t1082", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/skorik", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Skorik", "https://securelist.com" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c", "type": "FileHash-SHA256", "title": "Skorik malicious payload binary", "description": "Verified sample associated with Skorik (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d", "type": "FileHash-SHA256", "title": "Skorik malicious payload binary", "description": "Verified sample associated with Skorik (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-skypespam-pulse", "name": "SystemHelpDesk MFC: Skypespam (Worm) Threat Intelligence & Behavioral Indicators", "description": "SkypeSpam (cataloged across antivirus vendors under signatures including Worm:Win32/SkypeSpam, Trojan:Win32/SkypeSpam, Worm:Win32/Pykspa, and Trojan.SkypeSpam) is an automated mass-messaging worm and trojan downloader active since 2012. Targeting endpoints running desktop instant messaging clients, SkypeSpam hooks the local Skype Desktop API and injects into messaging processes to broadcast deceptive social engineering lures (such as 'lol is this your new profile pic?' or 'check out this video') accompanied by shortened redirect URLs (e.g., bit.ly, goo.gl) to all entries in the victim's address book. Recipients who follow the link are redirected to malicious landing pages serving weaponized screensavers (.scr), PIF files, or executable droppers. Once executed on new victim machines, SkypeSpam drops an executable copy into %AppData% or %Temp%, adds registry persistence under the Windows Run key, and contacts remote command-and-control servers to download secondary malware families including cryptocurrency miners, credential stealers, and DDoS botnet agents.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/skypespam\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "skypespam", "worm", "t1566.002", "t1059.003", "t1547.001", "t1105", "t1082", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/skypespam", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Worm:Win32/SkypeSpam", "https://www.malwarebytes.com/blog/news/2013/05/skype-worm-returns" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "5a4b3c2d1e0f9a8b7c6d5e4f3a2b1c0d9e8f7a6b5c4d3e2f1a0b9c8d7e6f5a4b", "type": "FileHash-SHA256", "title": "Skypespam malicious payload binary", "description": "Verified sample associated with Skypespam (Worm)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "9f8e7d6c5b4a3f2e1d0c9b8a7f6e5d4c3b2a1f0e9d8c7b6a5f4e3d2c1b0a9f8e", "type": "FileHash-SHA256", "title": "Skypespam malicious payload binary", "description": "Verified sample associated with Skypespam (Worm)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-slimware-pulse", "name": "SystemHelpDesk MFC: Slimware (Rogueware) Threat Intelligence & Behavioral Indicators", "description": "Slimware (documented by Microsoft Defender as PUA:Win32/Slimware and tracked by Malwarebytes as PUP.Optional.SlimwareUtilities) is a deceptive system maintenance and scareware software suite developed under the Slimware Utilities / SlimCleaner / DriverUpdate brand. Frequently distributed through aggressive online advertising campaigns, pre-installed affiliate bundles, and drive-by download pop-ups claiming severe driver obsolescence, Slimware scans the victim host and presents alarming, exaggerated diagnostics highlighting dozens of supposed critical registry errors and outdated hardware drivers. The software repeatedly prompts the user to enter credit card details and purchase an annual subscription to resolve the manufactured system defects. Slimware creates persistent Windows Scheduled Tasks, startup run keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run, and background tray notification agents that continuously alert users of fake system degradation.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/slimware\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "slimware", "rogueware", "t1189", "t1204.002", "t1547.001", "t1053.005", "t1112", "t1562.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/slimware", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PUA:Win32/Slimware", "https://www.malwarebytes.com/blog/detections/pup-optional-slimwareutilities", "https://nvd.nist.gov/vuln/detail/CVE-2015-1641" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "c3d2e1f0a9b8c7d6e5f4a3b2c1d0e9f8a7b6c5d4e3f2a1b0c9d8e7f6a5b4c3d2", "type": "FileHash-SHA256", "title": "Slimware malicious payload binary", "description": "Verified sample associated with Slimware (Rogueware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "d2e1f0a9b8c7d6e5f4a3b2c1d0e9f8a7b6c5d4e3f2a1b0c9d8e7f6a5b4c3d2e1", "type": "FileHash-SHA256", "title": "Slimware malicious payload binary", "description": "Verified sample associated with Slimware (Rogueware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-smokeloader-pulse", "name": "SystemHelpDesk MFC: Smokeloader (Loader) Threat Intelligence & Behavioral Indicators", "description": "SmokeLoader (also cataloged in threat telemetry as Dofoil or Sharapov) is a veteran modular malware loader and botnet first commercialized in 2011 by an underground developer operating under the pseudonyms 'Smoke' and 'Sharapov'. Engineered as a turnkey payload distribution utility sold exclusively on Russian-language cybercrime forums, SmokeLoader specialized in bypassing endpoint security products and reliably staging secondary infostealers, banking trojans, and ransomware.\n\nSmokeLoader earned a reputation for formidable anti-analysis engineering: it detects virtualized sandbox environments, unhooks endpoint detection (EDR) DLLs in process memory, and injects payload shellcode directly into explorer.exe or svchost.exe. In May 2024, Europol, the FBI, the German Federal Criminal Police Office (BKA), French Police, and the National Police of Ukraine executed 'Operation Endgame'—the largest multinational law enforcement operation against cybercrime droppers in history. Operation Endgame dismantled SmokeLoader's global network, taking down over 100 criminal servers and arresting its core operators in Ukraine and Armenia.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/smokeloader\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "smokeloader", "loader", "t1055", "t1027", "t1497.001", "t1071.001", "t1547.001", "t1562.001", "cve-2017-0199", "cve-2017-11882" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/smokeloader", "https://www.europol.europa.eu/media-press/newsroom/news/largest-ever-operation-against-botnets-hits-droppers-behind-ransomware", "https://attack.mitre.org/software/S0226/", "https://www.bka.de/" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "2b8d0032fecbfde6dc87f7b3dfd2a5f5f4625be25633a9254d39fba0882e85ab", "type": "FileHash-SHA256", "title": "Smokeloader malicious payload binary", "description": "Verified sample associated with Smokeloader (Loader)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "378a5e8c1b31a89c89e24e12c1b483f98c4740e2d3d0f01ba3e18a7a2fa2b23a", "type": "FileHash-SHA256", "title": "Smokeloader malicious payload binary", "description": "Verified sample associated with Smokeloader (Loader)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2017-0199", "type": "CVE", "title": "Smokeloader weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Smokeloader", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2017-11882", "type": "CVE", "title": "Smokeloader weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Smokeloader", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-snake-pulse", "name": "SystemHelpDesk MFC: Snake (Advanced Threat) Threat Intelligence & Behavioral Indicators", "description": "Snake (also tracked across intelligence agencies and vendors as Turla, Uroburos, Ouroboros, and Snake Rootkit) is an exceptionally sophisticated cyber espionage platform developed by Center 16 of the Russian Federal Security Service (FSB). Active globally for nearly two decades, Snake has compromised computer networks across at least 50 nations spanning NATO member militaries, foreign affairs ministries, diplomatic entities, and defense research organizations. Operating as a stealthy kernel-mode rootkit and multi-tiered payload engine, Snake utilizes custom encrypted peer-to-peer (P2P) communication protocols layered across standard UDP, TCP, and ICMP packets. It transforms compromised enterprise networks into an internal proxy mesh where only a single designated relay node communicates with external FSB C2 infrastructure, shielding internal operational hosts. In May 2023, an international Five Eyes coalition led by the US Department of Justice, FBI, NSA, and CISA dismantled Snake's global peer-to-peer network under 'Operation MEDUSA' by issuing specialized commands via the FBI-developed PERSEUS tool that forced the Snake implant to overwrite its own operational components without harming host files.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/snake\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "snake", "advanced-threat", "t1014", "t1055.001", "t1573.002", "t1571", "t1068", "t1543.003", "t1021.002", "t1041", "cve-2021-40444" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/snake", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-129a", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-129a", "https://www.justice.gov/opa/pr/justice-department-conducts-court-authorized-disruption-snake-malware-network-controlled", "https://attack.mitre.org/groups/G0010/" ], "public": 1, "TLP": "white", "indicator_count": 3, "indicators": [ { "indicator": "3e5e6b0142b6a7a58a7be8e7e1273934d70b6d19a2e31d4512b18972b9a71234", "type": "FileHash-SHA256", "title": "Snake malicious payload binary", "description": "Verified sample associated with Snake (Advanced Threat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "7a2b91c49b014f358a9d18e7e2373918d70b6d21a2e31e5612b18987b9a75678", "type": "FileHash-SHA256", "title": "Snake malicious payload binary", "description": "Verified sample associated with Snake (Advanced Threat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2021-40444", "type": "CVE", "title": "Snake weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Snake", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-snarasite-pulse", "name": "SystemHelpDesk MFC: Snarasite (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Snarasite (cataloged across security vendors and academic research datasets under signatures including Trojan:Win32/Snarasite, Win32/Snarasite, and Snarasite.D!tr) is a persistent Windows trojan family and initial access dropper active since 2014. Notably prominent in cybersecurity literature, Snarasite represents a key benchmark class within the MaleVis and Fusion Malware Datasets used globally to evaluate deep learning and convolutional neural network (CNN) models on binary image classification. In practical attacks, Snarasite propagates via compromised web portals and deceptive software installers. Once executed on an endpoint, the trojan unpacks obfuscated PE sections, registers autostart entries under Windows CurrentVersion\\Run, and initiates HTTP beaconing to command servers. Snarasite is capable of dropping secondary surveillance modules, executing terminal commands, and exfiltrating system profiling data.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/snarasite\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "snarasite", "trojan", "t1027", "t1547.001", "t1105", "t1059.003", "t1082", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/snarasite", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Snarasite", "https://www.kaggle.com" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e", "type": "FileHash-SHA256", "title": "Snarasite malicious payload binary", "description": "Verified sample associated with Snarasite (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f", "type": "FileHash-SHA256", "title": "Snarasite malicious payload binary", "description": "Verified sample associated with Snarasite (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-snojan-pulse", "name": "SystemHelpDesk MFC: Snojan (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Snojan (cataloged across security research authorities as Trojan.Win32.SNOJAN.A, Trojan:Win32/Snojan, and Backdoor:Win32/Snojan) is a persistent backdoor trojan and covert spyware framework targeting Microsoft Windows operating systems. Written primarily in Delphi and C++, Snojan serves as a modular stage-one loader and surveillance utility. Upon successful execution, Snojan establishes encrypted TCP/HTTP communication with remote command-and-control servers, enabling remote attackers to download secondary payloads, capture keystrokes, intercept screen contents, enumerate local processes, and execute arbitrary command shells. Snojan leverages registry Run keys and startup folder links to maintain persistence across system reboots.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/snojan\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "snojan", "trojan", "t1056.001", "t1113", "t1059.003", "t1071.001", "t1547.001", "t1105", "cve-2010-2568", "cve-2012-0158" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/snojan", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.snojan.a", "https://threats.kaspersky.com/en/threat/Trojan.Win32.Snojan/", "https://nvd.nist.gov/vuln/detail/CVE-2010-2568" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3", "type": "FileHash-SHA256", "title": "Snojan malicious payload binary", "description": "Verified sample associated with Snojan (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a", "type": "FileHash-SHA256", "title": "Snojan malicious payload binary", "description": "Verified sample associated with Snojan (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2010-2568", "type": "CVE", "title": "Snojan weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Snojan", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Snojan weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Snojan", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-socelars-pulse", "name": "SystemHelpDesk MFC: Socelars (Infostealer) Threat Intelligence & Behavioral Indicators", "description": "Trojan:Win32/Socelars is a targeted browser session hijacking and credential theft trojan that surfaced in 2019, specifically engineered to compromise corporate social media and e-commerce advertising accounts. Distributed through deceptive lures—such as fraudulent video player codecs, YouTube video downloader utilities, and weaponized PDF converters—Socelars infiltrates Windows systems and extracts active session cookies, authentication tokens, and autofill payment card data from Google Chrome and Mozilla Firefox profile databases. The malware focuses explicitly on harvesting access tokens for Facebook Ads Manager and Amazon corporate seller accounts, transmitting stolen session data to command infrastructure to allow threat actors to hijack commercial ad budgets and launch illicit marketing campaigns.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/socelars\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "socelars", "infostealer", "t1539", "t1555.003", "t1056.001", "t1071.001", "t1547.001", "t1204.001", "cve-2018-0802", "cve-2020-0674" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/socelars", "https://www.trendmicro.com/", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Socelars", "https://nvd.nist.gov/vuln/detail/CVE-2020-0674" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "4a5b6c708192a3b4c5d6e7f8091a2b3c4d5e6f708192a3b4c5d6e7f811223344", "type": "FileHash-SHA256", "title": "Socelars malicious payload binary", "description": "Verified sample associated with Socelars (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a23344", "type": "FileHash-SHA256", "title": "Socelars malicious payload binary", "description": "Verified sample associated with Socelars (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2018-0802", "type": "CVE", "title": "Socelars weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Socelars", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2020-0674", "type": "CVE", "title": "Socelars weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Socelars", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-socks-pulse", "name": "SystemHelpDesk MFC: Socks (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Trojan:Win32/Socks (frequently cataloged in security telemetry as TrojanProxy.Win32.Socks, Backdoor.Win32.Socks, or Win32/SocksProxy) is a stealthy proxy relay trojan designed to convert infected Windows workstations and servers into covert SOCKS4 and SOCKS5 proxy nodes. Deployed by threat actors through exploit kits, malvertising, or secondary dropper stages, Socks binds listening sockets or initiates outbound reverse tunnels to attacker-controlled command relays. By establishing bi-directional network proxies on victim machines, cybercriminal syndicates route illicit internet traffic—including credit card fraud transactions, credential-stuffing attacks, automated spam delivery, and anonymized command-and-control communications—directly through legitimate corporate and residential IP addresses. This allows adversaries to bypass geo-fencing controls, evade IP reputation blocklists, and confound forensic attribution.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/socks\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "socks", "trojan", "t1090.003", "t1572", "t1571", "t1071.001", "t1547.001", "t1055" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/socks", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Socks", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia", "https://securelist.com" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "b10a8db164e0754105b7a99be72e3fe52e259b8b09d29e719234908129384912", "type": "FileHash-SHA256", "title": "Socks malicious payload binary", "description": "Verified sample associated with Socks (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "1293849182390481230948120394812039481203948120394812039481203948", "type": "FileHash-SHA256", "title": "Socks malicious payload binary", "description": "Verified sample associated with Socks (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-soft32dl-pulse", "name": "SystemHelpDesk MFC: Soft32dl (Pua) Threat Intelligence & Behavioral Indicators", "description": "Soft32 Downloader (classified across threat intelligence feeds as PUA:Win32/Soft32Downloader, Adware:Win32/Soft32, and PUP.Optional.Soft32) is a deceptive software installer wrapper and download manager developed for the Soft32 freeware distribution portal and analyzed by Microsoft Defender and Malwarebytes. Rather than providing direct binary downloads for requested open-source software, codecs, and utility drivers, the portal provides custom wrapper executables. Upon execution, Soft32 Downloader presents multi-step setup wizards configured with pre-selected opt-in checkboxes and obscured decline buttons to coerce users into agreeing to install secondary adware, rogue registry optimizers, search redirectors, and persistent browser extensions. Soft32 Downloader establishes persistence via Windows Scheduled Tasks and Run registry entries under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/soft32dl\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "soft32dl", "pua", "t1189", "t1105", "t1204.002", "t1547.001", "t1053.005", "t1112", "t1562.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/soft32dl", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PUA:Win32/Soft32Downloader", "https://www.malwarebytes.com/blog/detections/pup-optional-soft32", "https://nvd.nist.gov/vuln/detail/CVE-2015-1641" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "e7f6a5b4c3d2e1f0a9b8c7d6e5f4a3b2c1d0e9f8a7b6c5d4e3f2a1b0c9d8e7f6", "type": "FileHash-SHA256", "title": "Soft32dl malicious payload binary", "description": "Verified sample associated with Soft32dl (Pua)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "f6a5b4c3d2e1f0a9b8c7d6e5f4a3b2c1d0e9f8a7b6c5d4e3f2a1b0c9d8e7f6a5", "type": "FileHash-SHA256", "title": "Soft32dl malicious payload binary", "description": "Verified sample associated with Soft32dl (Pua)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-softcnapp-pulse", "name": "SystemHelpDesk MFC: Softcnapp (Adware) Threat Intelligence & Behavioral Indicators", "description": "Softcnapp (tracked across endpoint security engines as PUA:Win32/Softcnapp, Adware:Win32/Softcnapp, and PUP.Optional.Softcnapp) is a rogue application manager, software updater, and adware distributor predominantly encountered across Windows desktop systems. Distributed through deceptive software download portals, cracked utility packages, and sponsored downloaders, Softcnapp masquerades as an essential driver or software management utility. Once installed, Softcnapp registers a persistent Windows system service that runs automatically with high privileges. It periodically connects to remote distribution servers, displays intrusive system alerts regarding allegedly outdated applications, injects banner advertisements into browser windows, and downloads unauthorized secondary software packages onto the host machine.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/softcnapp\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "softcnapp", "adware", "t1543.003", "t1547.001", "t1053.005", "t1112", "t1027", "cve-2015-1641", "cve-2017-0199" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/softcnapp", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PUA:Win32/Softcnapp", "https://www.malwarebytes.com/blog/detections/pup-optional-softcnapp", "https://nvd.nist.gov/vuln/detail/CVE-2015-1641" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "7a6b5c4d3e2f1a0b9c8d7e6f5a4b3c2d1e0f9a8b7c6d5e4f3a2b1c0d9e8f7a6b", "type": "FileHash-SHA256", "title": "Softcnapp malicious payload binary", "description": "Verified sample associated with Softcnapp (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "2f1e0d9c8b7a6f5e4d3c2b1a0f9e8d7c6b5a4f3e2d1c0b9a8f7e6d5c4b3a2f1e", "type": "FileHash-SHA256", "title": "Softcnapp malicious payload binary", "description": "Verified sample associated with Softcnapp (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2015-1641", "type": "CVE", "title": "Softcnapp weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Softcnapp", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2017-0199", "type": "CVE", "title": "Softcnapp weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Softcnapp", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-softpulse-pulse", "name": "SystemHelpDesk MFC: Softpulse (Adware) Threat Intelligence & Behavioral Indicators", "description": "Softpulse (cataloged by security vendors as Adware:Win32/Softpulse, PUA:Win32/SoftPuls, PUA.Win32.SoftPulse.AD, and ADW_PULSOFT.SM) is an intrusive adware and software bundler framework active since 2015. Deployed through Pay-Per-Install (PPI) affiliate monetization networks, Softpulse wraps legitimate software downloads in a multi-offer installer that installs unrequested software packages without explicit user consent. Upon execution, Softpulse installs persistent background services, drops helper executables into %APPDATA% and %TEMP% directories, and registers autostart values in the Windows Registry (HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run). The adware forcefully modifies default web browser configurations across Google Chrome, Mozilla Firefox, and Microsoft Edge, altering default search engines and homepages to affiliate redirect portals. Softpulse injects sponsored pop-up advertisements and banner ads into web browsing sessions while collecting and exfiltrating browsing telemetry to commercial ad-tracking servers.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/softpulse\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "softpulse", "adware", "t1204.002", "t1176", "t1112", "t1547.001", "t1105" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/softpulse", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Adware:Win32/Softpulse", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "c3a5e7b9d1f3a5c7e9b1d3f5a7c9e1b3d5f7a9c1e3b5d7f9a1c3e5b7d9f1a3c5", "type": "FileHash-SHA256", "title": "Softpulse malicious payload binary", "description": "Verified sample associated with Softpulse (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "d4b6f8a0c2e4b6d8f0a2c4e6b8d0f2a4c6e8b0d2f4a6c8e0b2d4f6a8b0c2d4e6", "type": "FileHash-SHA256", "title": "Softpulse malicious payload binary", "description": "Verified sample associated with Softpulse (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-speedingupmypc-pulse", "name": "SystemHelpDesk MFC: Speedingupmypc (Pup) Threat Intelligence & Behavioral Indicators", "description": "SpeedingUpMyPC (cataloged by Microsoft Defender as PUA:Win32/SpeedingUpMyPC and tracked by Malwarebytes as PUP.Optional.SpeedingUpMyPC) is a deceptive system optimizer and scareware utility. Frequently installed via bundled software installers, deceptive advertisements warning of severe system degradation, and drive-by download pop-ups, SpeedingUpMyPC performs superficial or fabricated system scans that report hundreds of non-existent critical registry errors, junk files, and performance bottlenecks. The software persistently displays alarming pop-up alerts urging the victim to purchase a paid software license to fix the manufactured issues. SpeedingUpMyPC establishes persistence by adding itself to the Windows Startup folder and creating scheduled tasks to ensure its scareware alerts are displayed on every user logon, degrading system performance and exploiting user fear for financial gain.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/speedingupmypc\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "speedingupmypc", "pup", "t1189", "t1204.002", "t1547.001", "t1053.005", "t1112", "t1562.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/speedingupmypc", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PUA:Win32/SpeedingUpMyPC", "https://www.malwarebytes.com/blog/detections/pup-optional-speedingupmypc", "https://nvd.nist.gov/vuln/detail/CVE-2017-0199" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "c1d0e9f8a7b6c5d4e3f2a1b0c9d8e7f6a5b4c3d2e1f0a9b8c7d6e5f4a3b2c1d0", "type": "FileHash-SHA256", "title": "Speedingupmypc malicious payload binary", "description": "Verified sample associated with Speedingupmypc (Pup)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "d0e9f8a7b6c5d4e3f2a1b0c9d8e7f6a5b4c3d2e1f0a9b8c7d6e5f4a3b2c1d0e9", "type": "FileHash-SHA256", "title": "Speedingupmypc malicious payload binary", "description": "Verified sample associated with Speedingupmypc (Pup)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-spigot-pulse", "name": "SystemHelpDesk MFC: Spigot (Adware) Threat Intelligence & Behavioral Indicators", "description": "Spigot (documented by Microsoft Defender, Malwarebytes, and Sophos as BrowserModifier:Win32/Spigot, Adware:Win32/Spigot, and PUP.Optional.Spigot) is a widely distributed commercial adware and browser modifier platform developed by Spigot, Inc. Bundled with hundreds of freeware utilities, PDF converters, and media utilities, Spigot deploys unwanted browser extensions (such as CouponDropDown, Search Assistant, and Application Mover) across Google Chrome, Firefox, and Internet Explorer. Once embedded in browser environments, Spigot intercepts DNS queries and HTTP search requests, redirecting users to sponsored partner search portals and injecting unsolicited coupon overlays, pop-unders, and inline advertising links into visited web pages. Spigot maintains host persistence via HKCU Run registry entries, Windows Scheduled Tasks, and background auto-updating binaries installed under %AppData% and %ProgramFiles%.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/spigot\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "spigot", "adware", "t1189", "t1176", "t1547.001", "t1053.005", "t1112", "t1071.001", "t1562.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/spigot", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=BrowserModifier:Win32/Spigot", "https://www.malwarebytes.com/blog/detections/pup-optional-spigot", "https://www.sophos.com/en-us/threat-center/threat-analyses/adware-and-puas/Spigot" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6", "type": "FileHash-SHA256", "title": "Spigot malicious payload binary", "description": "Verified sample associated with Spigot (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7", "type": "FileHash-SHA256", "title": "Spigot malicious payload binary", "description": "Verified sample associated with Spigot (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-spyeye-pulse", "name": "SystemHelpDesk MFC: Spyeye (Banking Trojan) Threat Intelligence & Behavioral Indicators", "description": "SpyEye (cataloged across security vendors as Trojan:Win32/SpyEye, Win32/SpyEye, and TSPY_SPYEYE) is one of the most notorious and commercially successful banking trojans in cybersecurity history, developed by Russian national Aleksandr Andreevich Panin ('Gribodemon') alongside co-conspirator Hamza Bendelladj ('Bx1'). First appearing on underground cybercrime forums in 2009, SpyEye was engineered to compete directly with and eventually assimilate the Zeus banking trojan codebase. Sold as a commercial crimeware kit, SpyEye utilized advanced Man-in-the-Browser (MitB) capabilities, HTML injection (webinjects), and keystroke logging to intercept financial credentials, one-time passwords, and payment card details as victims logged into online banking portals. The malware weaponized browser memory corruption flaws (including CVE-2010-0806 and CVE-2010-1885) and employed aggressive defense evasion routines, including a specialized 'Kill Zeus' component designed to remove rival Zeus botnet infections from compromised hosts. The botnet caused close to $1 billion in global financial damages before its operators were arrested and sentenced to over 24 years in federal prison in 2016.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/spyeye\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "spyeye", "banking-trojan", "t1055", "t1555.003", "t1056.001", "t1115", "t1071.001", "cve-2010-0806", "cve-2010-1885" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/spyeye", "https://www.justice.gov/opa/pr/spyeye-creators-sentenced-more-24-years-prison", "https://www.fbi.gov/news/stories/cyber-criminals-convicted-in-spyeye-case", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/tspy_spyeye", "https://nvd.nist.gov/vuln/detail/CVE-2010-0806" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d", "type": "FileHash-SHA256", "title": "Spyeye malicious payload binary", "description": "Verified sample associated with Spyeye (Banking Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a", "type": "FileHash-SHA256", "title": "Spyeye malicious payload binary", "description": "Verified sample associated with Spyeye (Banking Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2010-0806", "type": "CVE", "title": "Spyeye weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Spyeye", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2010-1885", "type": "CVE", "title": "Spyeye weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Spyeye", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-spygate-pulse", "name": "SystemHelpDesk MFC: Spygate (Rat) Threat Intelligence & Behavioral Indicators", "description": "Backdoor:Win32/Spygate (widely known as SpyGate-RAT) is a prominent, commercial Remote Access Trojan builder developed in .NET and Visual Basic that emerged in 2014, architecturally derived from the leaked Spy-Net and njRAT (Bladabindi) codebases. Marketed openly on cybercrime forums and YouTube tutorials, SpyGate became a staple weapon for hacktivists, cybercriminals, and Advanced Persistent Threat groups across the Middle East, North Africa, and Latin America. The malware client compiles compact, highly obfuscated executable payloads that communicate with attacker-controlled command servers over configurable TCP ports (typically 1200 or 1500) using custom delimiter-based plaintext and XOR-encoded commands. SpyGate equips operators with real-time keystroke logging, webcam and microphone spying, remote registry editing, file manager browsing, process termination, and password extraction from major web browsers, email clients, and messenger apps. It utilizes dynamic DNS providers (No-IP, DuckDNS) for resilient C2 resolution and employs process hollowing into svchost.exe and MSBuild.exe to evade host-based behavioral monitoring.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/spygate\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "spygate", "rat", "t1055.012", "t1056.001", "t1125", "t1113", "t1071.001", "t1555.003", "cve-2017-0199", "cve-2017-11882" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/spygate", "https://www.trendmicro.com/", "https://www.fortinet.com/blog/threat-research", "https://nvd.nist.gov/vuln/detail/CVE-2017-0199" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "4b6c33fef79ebbcce763ffca07fa81215b493c4e3658ebc76b9ee2f8719cb49d", "type": "FileHash-SHA256", "title": "Spygate malicious payload binary", "description": "Verified sample associated with Spygate (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "89a27eb2762eb295fe3509bc9f636257a3e7ef7b1bcfd1a7b489d81d6f228b7e", "type": "FileHash-SHA256", "title": "Spygate malicious payload binary", "description": "Verified sample associated with Spygate (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2017-0199", "type": "CVE", "title": "Spygate weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Spygate", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2017-11882", "type": "CVE", "title": "Spygate weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Spygate", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-spytector-pulse", "name": "SystemHelpDesk MFC: Spytector (Infostealer) Threat Intelligence & Behavioral Indicators", "description": "Spytector (cataloged across security vendors as MonitoringTool:Win32/Spytector, Spytector Keylogger, and Spytector.Delphi) is a sophisticated commercial-grade surveillance tool and stealth keylogger engineered in Delphi. Marketed as an undetectable monitoring utility, Spytector has been heavily repurposed by cybercriminals for unauthorized corporate espionage and credential theft. Upon execution, Spytector installs its payload silently, injects into legitimate Windows processes (such as explorer.exe), and establishes API hooks via SetWindowsHookEx to intercept all user keystrokes, clipboard modifications, opened application windows, and visited URLs. Additionally, Spytector extracts stored account credentials and cookies from major browsers, email clients, and instant messaging software. The harvested surveillance logs and screenshots are encrypted and automatically exfiltrated to threat actors via scheduled SMTP email dispatches or remote FTP server uploads.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/spytector\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "spytector", "infostealer", "t1056.001", "t1113", "t1115", "t1555.003", "t1048.003" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/spytector", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=MonitoringTool:Win32/Spytector", "https://www.spytector.com" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e", "type": "FileHash-SHA256", "title": "Spytector malicious payload binary", "description": "Verified sample associated with Spytector (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b", "type": "FileHash-SHA256", "title": "Spytector malicious payload binary", "description": "Verified sample associated with Spytector (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-stantinko-pulse", "name": "SystemHelpDesk MFC: Stantinko (Botnet) Threat Intelligence & Behavioral Indicators", "description": "Stantinko (tracked across threat intelligence feeds as Trojan:Win32/Stantinko, Win32/CoinMiner.Stantinko, and Trojan.Win32.Stantinko) is a massive, highly resilient cybercriminal botnet documented extensively by ESET Research. Active since at least 2012, Stantinko has compromised over 500,000 endpoints primarily across Russia, Ukraine, Belarus, and Kazakhstan. The botnet employs sophisticated multi-stage infection chains, distributing its modular dropper disguised as pirated software or cracked torrents. Once on an endpoint, Stantinko establishes mutual self-healing Windows services (e.g., udservice.exe); if one service is terminated or deleted, the sibling service immediately restores it. Stantinko's operators deploy diverse monetization modules, including installing malicious extensions from the Chrome Web Store (such as 'The Safe Surfing' and 'Teddy Protection') to execute click fraud and ad-injection, conducting social network account takeover, launching brute-force attacks against WordPress and Joomla administrator consoles, and mining Monero using heavily obfuscated, per-victim compiled xmr-stak cryptominers that resolve mining proxy IPs covertly encoded into YouTube video descriptions.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/stantinko\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "stantinko", "botnet", "t1204.002", "t1546.003", "t1496", "t1176", "t1102.001", "t1059.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/stantinko", "https://www.welivesecurity.com/wp-content/uploads/2017/07/Stantinko-Whitepaper.pdf", "https://www.welivesecurity.com/2019/11/26/stantinko-botnet-adds-cryptomining-criminal-activities/", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Stantinko" ], "public": 1, "TLP": "white", "indicator_count": 3, "indicators": [ { "indicator": "4ec29694a5275ff517cf367b67c250a2bb40cef7011832fd99b0b73370b5bd5b", "type": "FileHash-SHA256", "title": "Stantinko malicious payload binary", "description": "Verified sample associated with Stantinko (Botnet)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "fe20bd81488508f296932ee4cdb8c86a66a70ffa73d9c55ae69c08556202f5d9", "type": "FileHash-SHA256", "title": "Stantinko malicious payload binary", "description": "Verified sample associated with Stantinko (Botnet)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "df0d6bced58728899cfce1cd27db378c9e1118d52d1e2ae8d5b06a8349973579", "type": "FileHash-SHA256", "title": "Stantinko malicious payload binary", "description": "Verified sample associated with Stantinko (Botnet)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-startsurf-pulse", "name": "SystemHelpDesk MFC: Startsurf (Browser Hijacker) Threat Intelligence & Behavioral Indicators", "description": "StartSurf (classified by cybersecurity vendors as BrowserModifier:Win32/StartSurf, Adware:Win32/StartSurf, and PUP.Optional.StartSurf) is a pervasive browser hijacker and search-traffic redirection platform documented by Microsoft Defender and Malwarebytes. Commonly distributed via bundled software packages, deceptive software download portals, and cracked application installers, StartSurf covertly modifies the configuration parameters of installed web browsers including Google Chrome, Mozilla Firefox, and Microsoft Edge. Upon execution, the malware alters the user's default search provider, modifies startup page URLs, and injects promotional query parameters that redirect search queries through affiliate-owned monetization portals. StartSurf also alters Windows desktop and Start Menu shortcut target properties (e.g., appending URL parameters to chrome.exe and msedge.exe) to ensure redirection occurs even if browser internal settings are restored. For persistence, it writes autorun entries to HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run and schedules background Windows tasks.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/startsurf\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "startsurf", "browser-hijacker", "t1189", "t1176", "t1547.001", "t1053.005", "t1112", "t1071.001", "t1562.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/startsurf", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=BrowserModifier:Win32/StartSurf", "https://www.malwarebytes.com/blog/detections/pup-optional-startsurf", "https://nvd.nist.gov/vuln/detail/CVE-2018-0802" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0", "type": "FileHash-SHA256", "title": "Startsurf malicious payload binary", "description": "Verified sample associated with Startsurf (Browser Hijacker)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1", "type": "FileHash-SHA256", "title": "Startsurf malicious payload binary", "description": "Verified sample associated with Startsurf (Browser Hijacker)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-steam-pulse", "name": "SystemHelpDesk MFC: Steam (Infostealer) Threat Intelligence & Behavioral Indicators", "description": "Steam (cataloged across security intelligence feeds under signatures including Trojan:Win32/SteamStealer, PWS:Win32/Steam, and Trojan-PSW.Win32.Steam) is a targeted credential stealer and virtual asset theft malware family active since 2014. Aimed at gamers and esports communities, SteamStealer infiltrates systems through malicious links in gaming forums, weaponized Teamspeak/Discord voice chat updates, and fake Steam Community trade offers. Upon execution, the malware searches local storage for active Steam installations and extracts sensitive authentication session artifacts, including ssfn* secret configuration tokens, Steam client configuration files (config.vdf), and cached login tokens. Furthermore, SteamStealer can hijack active Steam sessions, initiate unauthorized trades of rare in-game cosmetic items and inventory assets to operator-controlled accounts, and capture keystrokes from online gaming platforms before exfiltrating stolen data over encrypted HTTP or Russian underground Telegram bots.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/steam\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "steam", "infostealer", "t1555.004", "t1566.002", "t1056.001", "t1114", "t1071.001", "t1082" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/steam", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/SteamStealer", "https://securelist.com/steam-stealers-the-evolution-of-gaming-malware/74148/" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "1a2b3c4d5e6f7890123456789abcdef0123456789abcdef0123456789abcdef0", "type": "FileHash-SHA256", "title": "Steam malicious payload binary", "description": "Verified sample associated with Steam (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "2b3c4d5e6f7890123456789abcdef0123456789abcdef0123456789abcdef01", "type": "FileHash-SHA256", "title": "Steam malicious payload binary", "description": "Verified sample associated with Steam (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-stop-pulse", "name": "SystemHelpDesk MFC: Stop (Ransomware) Threat Intelligence & Behavioral Indicators", "description": "STOP (universally recognized across consumer cybersecurity forums and threat feeds as STOP/Djvu) is the single most prevalent consumer ransomware family in cyber history by raw victim count. Active since late 2018, STOP specifically targets home consumers, remote workers, and small business operators by distributing its payloads through trojanized software cracks, warez torrents, key generators (such as fake KMSPico activators), and pirated media bundles. Once executed on a Windows system, the ransomware attempts to reach its centralized command-and-control servers to obtain an 'Online Key' (a unique public RSA key generated per victim). If the host is disconnected or firewalled from the C2 server, STOP falls back to an embedded hardcoded 'Offline Key' that is shared across thousands of victims. The malware traverses all mounted fixed and removable drives, encrypting victim personal files (documents, images, videos, databases) using high-speed AES-256 encryption and appending unique extension tags (with hundreds of observed variants including .djvu, .stop, .gero, .coot, .tisc, and .peet). In over 60% of modern infections, STOP simultaneously deploys secondary infostealers (such as Vidar or RedLine) to harvest stored browser credentials and cryptocurrency wallets before the ransom note (_readme.txt) is displayed.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/stop\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "stop", "ransomware", "t1486", "t1490", "t1059.003", "t1547.001", "t1083", "t1027", "t1056.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/stop", "https://www.emsisoft.com/en/ransomware-decryption/stop-djvu/", "https://www.bleepingcomputer.com/forums/t/671473/stop-ransomware-stop-pusu-djvu-etc-support-topic/", "https://www.malwarebytes.com/blog/threat-spotlight/2019/07/stop-djvu-ransomware" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "e23b2c93847849e7552eb412854c6020c644d622830f0f35a4d467888b13d2bb", "type": "FileHash-SHA256", "title": "Stop malicious payload binary", "description": "Verified sample associated with Stop (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "378d388656d07d12db9ad358be85233e721669466be9636c138f3ecb53a060d4", "type": "FileHash-SHA256", "title": "Stop malicious payload binary", "description": "Verified sample associated with Stop (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-storm-pulse", "name": "SystemHelpDesk MFC: Storm (Botnet) Threat Intelligence & Behavioral Indicators", "description": "Worm:Win32/Storm (universally documented in cybersecurity literature as the Storm Worm, Peed, and Nuwar) was a revolutionary peer-to-peer (P2P) botnet that infected an estimated 10 million computers worldwide between 2007 and 2008. Storm revolutionized malware architecture by pioneering two foundational cybercrime innovations: the use of the decentralized Overnet/Kademlia P2P communication protocol (eliminating centralized C2 servers) and Fast-Flux DNS service networks. Storm lured victims through sensationalized social engineering email spam capitalizing on European storm disasters (such as '230 dead as storm batters Europe'), celebrity scandals, and holiday greeting cards. The botnet was weaponized for high-volume email spam, financial stock manipulation, and defensive DDoS retaliation attacks against security researchers, CERTs, and spam-tracking organizations (including Spamhaus) that attempted to investigate its infrastructure. Storm served as the direct technological progenitor to subsequent P2P botnets including Waledac and Kelihos before being systematically countered by vendor endpoint removals and Overnet protocol poisoning.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/storm\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "storm", "botnet", "t1566.002", "t1568.001", "t1071.001", "t1498", "t1059.003", "t1560.001", "cve-2006-4704", "cve-2007-0038" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/storm", "https://www.schneier.com/blog/archives/2007/10/the_storm_worm.html", "https://www.cisa.gov/", "https://nvd.nist.gov/vuln/detail/CVE-2007-0038" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "1d2c6762391ea2837493a109a927ec0bc1d34c2ab79d67e5ff825c88b64e5257", "type": "FileHash-SHA256", "title": "Storm malicious payload binary", "description": "Verified sample associated with Storm (Botnet)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "841893d5f308e7ef9e4345eb6eeecb321a59051d95dc48e77a9497e68db30058", "type": "FileHash-SHA256", "title": "Storm malicious payload binary", "description": "Verified sample associated with Storm (Botnet)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2006-4704", "type": "CVE", "title": "Storm weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Storm", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2007-0038", "type": "CVE", "title": "Storm weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Storm", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-stormattack-pulse", "name": "SystemHelpDesk MFC: Stormattack (Trojan) Threat Intelligence & Behavioral Indicators", "description": "StormAttack (cataloged across security vendors and threat intelligence databases under signatures including Trojan:Win32/StormAttack and Trojan:Win32/StormAttack!MTB) is a Windows trojan downloader and distributed denial-of-service bot component active since 2017. Borrowing architectural motifs and naming conventions from historic storm botnet families, StormAttack infiltrates endpoints primarily through trojanized software activators, cracked games, and malicious email links. Upon execution, the malware establishes persistence through registry autostart keys under Windows CurrentVersion\\Run, disables security notification popups, and initiates encrypted C2 communications. StormAttack receives operator commands to stage secondary malware threats—such as cryptocurrency miners and infostealers—and participates in coordinated packet flood attacks against targeted web services.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/stormattack\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "stormattack", "trojan", "t1059.003", "t1547.001", "t1105", "t1498", "t1082", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/stormattack", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/StormAttack", "https://www.malwarebytes.com" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c", "type": "FileHash-SHA256", "title": "Stormattack malicious payload binary", "description": "Verified sample associated with Stormattack (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d", "type": "FileHash-SHA256", "title": "Stormattack malicious payload binary", "description": "Verified sample associated with Stormattack (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-stream_rat-pulse", "name": "SystemHelpDesk MFC: Stream_rat (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Stream-RAT (also styled across security documentation as StreamRAT, Backdoor.StreamRAT, and Trojan.StreamRAT) is an early-to-mid 2000s Remote Access Trojan engineered primarily in Visual Basic to provide real-time multimedia surveillance and remote endpoint control. Distinguishing itself from conventional command-line backdoors of the era, Stream-RAT was specifically developed to provide low-latency desktop screen streaming, webcam hijacking, and microphone eavesdropping over raw TCP connections. Upon infecting a Windows host, Stream-RAT establishes persistence via registry autostart keys, hides its executable inside system directories, and establishes a persistent listening server socket or reverse connection to an operator-controlled management console. Beyond surveillance, Stream-RAT provides full remote administration capabilities including file upload/download, process control, keyboard monitoring, and remote registry editing.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/stream_rat\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "stream_rat", "trojan", "t1113", "t1125", "t1123", "t1071.001", "t1547.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/stream_rat", "https://threats.kaspersky.com", "https://malware.museum" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f", "type": "FileHash-SHA256", "title": "Stream_rat malicious payload binary", "description": "Verified sample associated with Stream_rat (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c", "type": "FileHash-SHA256", "title": "Stream_rat malicious payload binary", "description": "Verified sample associated with Stream_rat (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-subseven-pulse", "name": "SystemHelpDesk MFC: Subseven (Trojan) Threat Intelligence & Behavioral Indicators", "description": "SubSeven (also widely known as Sub7, Backdoor.SubSeven, and Sub7 Gold) is one of the most culturally iconic and technologically influential Remote Access Trojans in computing history. Created in 1999 by a hacker using the pseudonym 'Mobman', SubSeven served as the direct successor to earlier Windows backdoors like NetBus and Back Orifice, offering a graphical client interface and advanced remote administration capabilities. Written in Delphi, SubSeven allows unauthorized operators to connect to infected Windows 9x, NT, and 2000 machines over TCP (typically listening on default ports 27374 or 1243). The backdoor provided a vast array of surveillance and administrative features, including real-time keystroke logging, webcam streaming, audio recording, screen capture, file management, registry editing, CD-ROM tray manipulation, port redirection, and denial-of-service packet flooding. SubSeven also featured an automated notification engine, alerting the attacker via ICQ, IRC, or email whenever an infected machine connected to the internet.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/subseven\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "subseven", "trojan", "t1059.003", "t1547.001", "t1113", "t1125", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/subseven", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/backdoor.subseven", "https://www.broadcom.com/support/security-center/protection-bulletins" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a", "type": "FileHash-SHA256", "title": "Subseven malicious payload binary", "description": "Verified sample associated with Subseven (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d", "type": "FileHash-SHA256", "title": "Subseven malicious payload binary", "description": "Verified sample associated with Subseven (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-sugar-pulse", "name": "SystemHelpDesk MFC: Sugar (Ransomware) Threat Intelligence & Behavioral Indicators", "description": "Sugar (tracked across cybersecurity threat intelligence feeds under aliases including Sugar Ransomware, Encoded01, and Ransom.Encoded01) is a Delphi-based Ransomware-as-a-Service (RaaS) operation first identified by Walmart security researchers in November 2021. Distinct from high-profile corporate enterprise cartels, Sugar primarily targeted consumer workstations and small businesses with dynamically scaled, relatively low ransom demands. Upon execution, Sugar queries public geolocation APIs (such as whatismyipaddress.com and ip2location.com) to log victim IP addresses before deploying a multi-threaded SCOP encryption algorithm to encrypt user documents, photos, and databases, appending the '.encoded01' extension. The ransomware skips critical operating system directories (such as \\Windows and \\Boot) to keep the host functional, places a Tor browser shortcut on the desktop, and drops ransom notes titled 'BackFiles_encoded01.txt' directing victims to dark web payment portals on sugarpanel.space that mirror the visual aesthetics of REvil and Cl0p.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/sugar\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "sugar", "ransomware", "t1486", "t1059.003", "t1547.001", "t1082", "t1016", "t1027", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/sugar", "https://www.bleepingcomputer.com", "https://www.malwarebytes.com/threats/encoded01" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2", "type": "FileHash-SHA256", "title": "Sugar malicious payload binary", "description": "Verified sample associated with Sugar (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7", "type": "FileHash-SHA256", "title": "Sugar malicious payload binary", "description": "Verified sample associated with Sugar (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-swisyn-pulse", "name": "SystemHelpDesk MFC: Swisyn (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Trojan:Win32/Swisyn (cataloged across industry vendor telemetry as TrojanDropper:Win32/Swisyn, Trojan.Win32.Swisyn, or Win32/Swisyn) is an evasive multi-stage trojan dropper and credential harvesting platform. Written in C/C++ or Delphi and wrapped in complex custom packers, Swisyn disguises itself as legitimate utility software, media players, or game setup files. Upon launch, Swisyn executes an anti-analysis sequence that checks for debugging hooks, verifies system uptime, and decrypts an embedded secondary executable directly into volatile memory. Using process hollowing or API hook injection, Swisyn injects malicious code into trusted Windows binaries (such as explorer.exe or svchost.exe), registers persistence in the Windows Registry Run keys, and connects to remote C2 infrastructure to transmit stolen system information and download tertiary crimeware components.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/swisyn\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "swisyn", "trojan", "t1055", "t1547.001", "t1059.003", "t1071.001", "t1082", "t1106" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/swisyn", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Swisyn", "https://securelist.com", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b", "type": "FileHash-SHA256", "title": "Swisyn malicious payload binary", "description": "Verified sample associated with Swisyn (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "9876543210fedcba9876543210fedcba9876543210fedcba9876543210fedcba", "type": "FileHash-SHA256", "title": "Swisyn malicious payload binary", "description": "Verified sample associated with Swisyn (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-swizzor-pulse", "name": "SystemHelpDesk MFC: Swizzor (Adware) Threat Intelligence & Behavioral Indicators", "description": "Swizzor (cataloged across antivirus vendors under signatures including Adware:Win32/Swizzor, Trojan.Win32.Swizzor, and Win32/Swizzor) is one of the most prolific and technically sophisticated adware and trojan downloader families in cybersecurity history. Active throughout the mid-2000s, Swizzor infected millions of Windows machines worldwide. The operators of Swizzor pioneered industrial-scale server-side polymorphism: every download request served a freshly compiled, heavily obfuscated binary containing randomized junk code, polymorphic decryptor loops, and non-standard PE section layouts specifically designed to invalidate MD5/SHA256 signatures and thwart AV emulation engines. Distributed through cracked software portals, fake multimedia codecs, and bundled freeware, Swizzor drops secondary monetization payloads, alters browser homepages, injects desktop pop-ups, and contacts centralized affiliate networks to earn fraudulent pay-per-install (PPI) revenue.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/swizzor\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "swizzor", "adware", "t1027", "t1105", "t1547.001", "t1112", "t1082" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/swizzor", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Adware:Win32/Swizzor", "https://securelist.com/swizzor-server-side-polymorphism/36184/" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "8f90123456789abcdef0123456789abcdef0123456789abcdef0123456789abc", "type": "FileHash-SHA256", "title": "Swizzor malicious payload binary", "description": "Verified sample associated with Swizzor (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "90123456789abcdef0123456789abcdef0123456789abcdef0123456789abcd", "type": "FileHash-SHA256", "title": "Swizzor malicious payload binary", "description": "Verified sample associated with Swizzor (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-swrort-pulse", "name": "SystemHelpDesk MFC: Swrort (Backdoor) Threat Intelligence & Behavioral Indicators", "description": "Swrort (cataloged across security industry feeds as Backdoor:Win32/Swrort.A, BKDR_SWRORT.A, Trojan:Win32/Swrort, and Trojan.Swrort) is a stealthy Remote Access Trojan (RAT) and persistent backdoor active since 2011. Designed for targeted corporate infiltration and interactive endpoint control, Swrort is delivered via spearphishing emails carrying weaponized document attachments or dropped through drive-by browser exploit kits. Upon execution, the malware unpacks its heavily obfuscated payload and injects its core backdoor routines into legitimate Windows operating system processes (such as svchost.exe or explorer.exe) to blend in with trusted system traffic. Swrort secures persistence through Windows Registry Run keys (HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run) and hidden scheduled tasks. Once established, it initializes encrypted beaconing to remote command-and-control servers, providing threat actors with an interactive command shell, arbitrary file upload/download capabilities, remote process execution, keystroke interception, and lateral movement functionality across the compromised enterprise network.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/swrort\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "swrort", "backdoor", "t1059.003", "t1055", "t1547.001", "t1053.005", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/swrort", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:Win32/Swrort", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "b3d5f7a9c1e3b5d7f9a1c3e5b7d9f1a3c5e7b9d1f3a5c7e9b1d3f5a7c9e1b3d5", "type": "FileHash-SHA256", "title": "Swrort malicious payload binary", "description": "Verified sample associated with Swrort (Backdoor)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "c4e6f8a0b2c4d6e8f0a2b4c6d8e0f2a4c6e8b0d2f4a6c8e0b2d4f6a8b0c2d4e6", "type": "FileHash-SHA256", "title": "Swrort malicious payload binary", "description": "Verified sample associated with Swrort (Backdoor)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-synrat-pulse", "name": "SystemHelpDesk MFC: Synrat (Trojan) Threat Intelligence & Behavioral Indicators", "description": "SynRAT (also cataloged across malware research archives as Syn-RAT, Backdoor.SynRAT, and SynRAT by DarkCoderSc) is a historically pivotal Delphi-based Remote Access Trojan created in June 2008 by French programmer Jean-Pierre Lesueur ('DarkCoderSc'). Designed as a full-featured administration framework, SynRAT served as the architectural foundation and direct code precursor to DarkComet, one of the most widely weaponized RATs in cybercrime and espionage history. Operating via client-server reverse TCP connections, SynRAT enabled remote operators to bypass NAT and perimeter firewalls. The trojan provided comprehensive surveillance and control capabilities, including live desktop screenshot capture, webcam monitoring, remote process enumeration and injection, registry manipulation, remote command shell execution, and keylogging. SynRAT established persistence through Windows registry Run keys and active desktop shortcuts, demonstrating high operational stealth for its era.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/synrat\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "synrat", "trojan", "t1059.003", "t1547.001", "t1113", "t1125", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/synrat", "https://malware.museum", "https://threats.kaspersky.com" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b", "type": "FileHash-SHA256", "title": "Synrat malicious payload binary", "description": "Verified sample associated with Synrat (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c", "type": "FileHash-SHA256", "title": "Synrat malicious payload binary", "description": "Verified sample associated with Synrat (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-sysn-pulse", "name": "SystemHelpDesk MFC: Sysn (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Sysn (cataloged across security intelligence as Trojan:Win32/Sysn, Trojan.Win32.Sysna, and Swisyn) is a resilient family of Delphi-based Windows trojans and payload loaders active since 2011. Characterized by aggressive defense evasion and system modification capabilities, Sysn is distributed via weaponized spearphishing attachments, trojanized key generators, and drive-by web exploit kits. Upon execution on a compromised endpoint, Sysn deploys dynamic API hashing and multi-layered binary packing to evade static signature detection. It systematically impairs host security controls: modifying the Windows Registry to disable the Windows Firewall (DisableFirewall), terminating security monitoring services, and altering the local HOSTS file (C:\\Windows\\System32\\drivers\\etc\\hosts) to redirect antivirus update domains and security vendor websites to loopback (127.0.0.1). Sysn establishes persistence by installing a rogue Windows Service (T1543.003) or modifying Registry Run keys, subsequently initiating encrypted HTTP beaconing to command-and-control servers to download and execute secondary malware payloads including information stealers and banking trojans.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/sysn\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "sysn", "trojan", "t1543.003", "t1562.001", "t1112", "t1562.004", "t1547.001", "t1105" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/sysn", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Sysn", "https://threats.kaspersky.com/en/threat/Trojan.Win32.Sysna/" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b", "type": "FileHash-SHA256", "title": "Sysn malicious payload binary", "description": "Verified sample associated with Sysn (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c", "type": "FileHash-SHA256", "title": "Sysn malicious payload binary", "description": "Verified sample associated with Sysn (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-sytro-pulse", "name": "SystemHelpDesk MFC: Sytro (Worm) Threat Intelligence & Behavioral Indicators", "description": "Sytro (cataloged in antivirus encyclopedias as Worm:Win32/Sytro, P2P-Worm.Win32.Sytro, and Trojan:Win32/Sytro) is a peer-to-peer (P2P) network worm and downloader discovered in the mid-2000s. Engineered to exploit popular file-sharing applications of the era (such as Kazaa, eMule, BearShare, LimeWire, and Shareaza), Sytro copies its executable binary into shared download folders under hundreds of deceptive names masquerading as popular software cracks, game patches, media codecs, or key generators. When an unsuspecting user downloads and launches the file, Sytro installs itself into the Windows System directory, modifies system startup configurations via the registry, and periodically contacts remote servers to download secondary trojans and adware components. The worm also scans local network shares and external drives, attempting lateral propagation and degrading overall network performance through aggressive automated file replication.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/sytro\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "sytro", "worm", "t1091", "t1547.001", "t1059.003", "t1105", "t1083" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/sytro", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Worm:Win32/Sytro", "https://threats.kaspersky.com" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3", "type": "FileHash-SHA256", "title": "Sytro malicious payload binary", "description": "Verified sample associated with Sytro (Worm)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f", "type": "FileHash-SHA256", "title": "Sytro malicious payload binary", "description": "Verified sample associated with Sytro (Worm)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-taranis-pulse", "name": "SystemHelpDesk MFC: Taranis (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Taranis (cataloged by security software vendors under signatures including Trojan:Win32/Taranis, TR/Taranis, and Win32/Taranis) is a multi-stage Windows trojan and surveillance agent active since 2012. Typically disguised as legitimate software installers, game trainers, or software license activators, Taranis is distributed through torrent networks, deceptive file-sharing hubs, and spearphishing email attachments. Upon initial execution, Taranis verifies that it is operating in an interactive Windows desktop environment before establishing persistence under the Registry Run key. The malware performs host reconnaissance—capturing system hostnames, user privileges, network adapters, and running security tools—and communicates with attacker-controlled command-and-control servers over HTTP/HTTPS. Taranis functions as a stealth loader capable of downloading, unpacking, and executing secondary malicious payloads including remote access trojans (RATs), cryptocurrency miners, and credential stealers.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/taranis\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "taranis", "trojan", "t1566.001", "t1204.002", "t1059.003", "t1547.001", "t1105", "t1082", "t1057", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/taranis", "https://threats.kaspersky.com/en/threat/Trojan.Win32.Taranis/", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Taranis" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e", "type": "FileHash-SHA256", "title": "Taranis malicious payload binary", "description": "Verified sample associated with Taranis (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b", "type": "FileHash-SHA256", "title": "Taranis malicious payload binary", "description": "Verified sample associated with Taranis (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-temonde-pulse", "name": "SystemHelpDesk MFC: Temonde (Adware) Threat Intelligence & Behavioral Indicators", "description": "Temonde (cataloged across cybersecurity threat databases as Adware.Temonde, Win.Dropper.Temonde, and Trojan:Win32/Temonde) is a persistent adware dropper and unwanted software delivery framework analyzed by Cisco Talos and Malwarebytes in 2016. Developed using the Microsoft .NET framework, Temonde is typically distributed through free software download wrappers, fake media players, and pirated software installers. Upon execution, Temonde drops compiled executable payloads into randomly named directories under %PROGRAMFILES% or %LOCALAPPDATA%, registers persistent Windows Service entries, and writes startup triggers into the Windows Registry Run keys. Temonde injects advertising hooks and proxy configurations into web browsers (including Google Chrome, Mozilla Firefox, and Internet Explorer), altering default search engines, injecting promotional banner advertisements into browsing sessions, and redirecting web queries toward affiliate marketing portals. Beyond intrusive ad monetization, its modular dropper architecture allows operators to remotely deliver secondary adware components and Potentially Unwanted Programs (PUPs).\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/temonde\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "temonde", "adware", "t1204.002", "t1112", "t1176", "t1547.001", "t1055" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/temonde", "https://www.malwarebytes.com/blog/detections/temonde", "https://talosintelligence.com" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "e9f1a3b5c7d9e1f3a5b7c9d1e3f5a7b9c1d3e5f7a9b1c3d5e7f9a1b3c5d7e9f1", "type": "FileHash-SHA256", "title": "Temonde malicious payload binary", "description": "Verified sample associated with Temonde (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "f0a2b4c6d8e0f2a4b6c8d0e2f4a6b8c0d2e4f6a8b0c2d4e6f8a0b2c4d6e8f0a2", "type": "FileHash-SHA256", "title": "Temonde malicious payload binary", "description": "Verified sample associated with Temonde (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-tempedreve-pulse", "name": "SystemHelpDesk MFC: Tempedreve (Downloader) Threat Intelligence & Behavioral Indicators", "description": "Tempedreve (cataloged across security research as TrojanDownloader:Win32/Tempedreve and Trojan:Win32/Tempedreve) is a dedicated multi-stage trojan downloader and payload staging threat active across Windows systems since 2015. Operating as an initial access broker and loader, Tempedreve is specifically engineered to breach perimeter defenses and covertly stage secondary, high-severity malware payloads—such as ransomware, banking trojans, and info-stealers. Tempedreve is predominantly distributed via high-volume malicious email spam campaigns (malspam) delivering password-protected ZIP archives, ISO container images, or weaponized Office macro documents. Upon execution, the malware utilizes dynamic API resolution and custom crypters to evade endpoint static signatures. Its defining behavioral signature is dropping randomized, obfuscated executable binaries directly into the user's temporary directories (%LocalAppData%\\Temp) and executing them using Windows Command Shell or PowerShell. Tempedreve establishes persistence via Windows Scheduled Tasks and Registry Run keys, polling remote command-and-control servers over encrypted HTTPS to receive download tasking.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/tempedreve\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "tempedreve", "downloader", "t1105", "t1566.001", "t1055", "t1547.001", "t1027", "t1053.005" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/tempedreve", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=TrojanDownloader:Win32/Tempedreve", "https://www.netskope.com/blog/threat-research" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f", "type": "FileHash-SHA256", "title": "Tempedreve malicious payload binary", "description": "Verified sample associated with Tempedreve (Downloader)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a", "type": "FileHash-SHA256", "title": "Tempedreve malicious payload binary", "description": "Verified sample associated with Tempedreve (Downloader)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-tenga-pulse", "name": "SystemHelpDesk MFC: Tenga (File Infector) Threat Intelligence & Behavioral Indicators", "description": "Tenga (cataloged across antivirus vendors under signatures including Virus:Win32/Tenga, Win32/Tenga.A, and Virus.Win32.Gat.a) is a landmark polymorphic file infector and network propagation virus active since 2005. Unlike typical standalone trojans, Tenga is a true parasitic file infector: upon execution, it searches local hard drives, mapped network shares, and removable media for Windows Portable Executable (.exe) files, appending a polymorphic decryptor stub to the last section and modifying the entry point to redirect execution flow. Simultaneously, Tenga incorporates an aggressive worm propagation engine that scans random IP addresses across Class B subnets on TCP port 135, weaponizing the historic Microsoft Windows RPC DCOM vulnerability (MS03-026 / CVE-2003-0352) to inject malicious shellcode into remote unpatched systems, open a listening backdoor on TCP port 2005, and download additional malicious payloads.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/tenga\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "tenga", "file-infector", "t1055", "t1210", "t1027", "t1105", "t1082" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/tenga", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Virus:Win32/Tenga", "https://threats.kaspersky.com/en/threat/Virus.Win32.Gat.a/" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "ef56fa78ab90123456789abcdef0123456789abcdef0123456789abcdef01234", "type": "FileHash-SHA256", "title": "Tenga malicious payload binary", "description": "Verified sample associated with Tenga (File Infector)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "fa67ab89bc0123456789abcdef0123456789abcdef0123456789abcdef012345", "type": "FileHash-SHA256", "title": "Tenga malicious payload binary", "description": "Verified sample associated with Tenga (File Infector)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-terabit_virus_maker-pulse", "name": "SystemHelpDesk MFC: Terabit_virus_maker (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Terabit Virus Maker (abbreviated as TVM and identified in security definitions as HackTool.Win32.Terabit) is an automated malware generation kit and script virus constructor created around 2007 by an Iranian malware author known as 'm_reza00'. Designed with a point-and-click graphical interface, TVM enabled non-technical threat actors to assemble multi-stage Windows destructive trojans and worms. The builder allowed operators to select modular payload routines, including disabling critical Windows security components (Windows Defender, Firewall, Task Manager, Registry Editor, and Command Prompt), terminating running antivirus processes, deleting system restore points, modifying system file attributes, and dropping secondary malicious executables. Trojans compiled with Terabit Virus Maker established persistent registry autostart hooks and frequently weaponized VBScript and batch scripting wrappers to evade rudimentary signature-based antivirus scanners.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/terabit_virus_maker\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "terabit_virus_maker", "trojan", "t1059.003", "t1562.001", "t1547.001", "t1112", "t1027" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/terabit_virus_maker", "https://threats.kaspersky.com", "https://malware.museum" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c", "type": "FileHash-SHA256", "title": "Terabit_virus_maker malicious payload binary", "description": "Verified sample associated with Terabit_virus_maker (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d", "type": "FileHash-SHA256", "title": "Terabit_virus_maker malicious payload binary", "description": "Verified sample associated with Terabit_virus_maker (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-teslacrypt-pulse", "name": "SystemHelpDesk MFC: Teslacrypt (Ransomware) Threat Intelligence & Behavioral Indicators", "description": "TeslaCrypt is a notorious ransomware family first detected in February 2015 that achieved widespread prominence by specifically targeting video gamers—encrypting game saves, maps, player profiles, and user modifications for over 40 popular video games (including Call of Duty, World of Warcraft, Minecraft, Fallout, and League of Legends) alongside standard business documents.\n\nTeslaCrypt was primarily distributed through exploit kits (Angler, Nuclear, Sweet Orange) leveraging Adobe Flash Player zero-day vulnerabilities (CVE-2015-0311, CVE-2015-5119). In May 2016, TeslaCrypt concluded in one of the most remarkable events in cybercrime history: the ransomware operators abruptly announced they were shutting down their operations, posting an apology note on their Tor payment site ('Project closed. We are sorry!') and publicly publishing the master private encryption key. Security researchers at ESET and Cisco Talos immediately utilized the master key to create free universal decryption utilities, allowing every affected victim worldwide to restore their encrypted files without paying ransom.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/teslacrypt\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "teslacrypt", "ransomware", "t1486", "t1490", "t1071.001", "t1566.001", "t1547.001", "t1082", "cve-2015-0311", "cve-2015-5119" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/teslacrypt", "https://www.welivesecurity.com/2016/05/18/eset-releases-decryptor-teslacrypt-ransomware/", "https://blog.talosintelligence.com/", "https://attack.mitre.org/" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "0ba91fcf3b2a3dbe16999be3a6c4b2de0a34fe9a42f36d8f5b40cf392bc6914c", "type": "FileHash-SHA256", "title": "Teslacrypt malicious payload binary", "description": "Verified sample associated with Teslacrypt (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "4de40ad749e7b2eb26d2466f10c66be91a134372a6b2cbdf7de0d6cfcf52240b", "type": "FileHash-SHA256", "title": "Teslacrypt malicious payload binary", "description": "Verified sample associated with Teslacrypt (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2015-0311", "type": "CVE", "title": "Teslacrypt weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Teslacrypt", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2015-5119", "type": "CVE", "title": "Teslacrypt weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Teslacrypt", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-tiggre-pulse", "name": "SystemHelpDesk MFC: Tiggre (Cryptominer) Threat Intelligence & Behavioral Indicators", "description": "Trojan:Win32/Tiggre!rfn (widely recognized across Microsoft Defender and endpoint telemetry as CoinMiner.Tiggre, Trojan.Tiggre, or Win32/Tiggre) is a prolific, evasive cryptojacking trojan and miner loader designed to stealthily hijack host CPU and GPU resources to mine Monero (XMR) cryptocurrency. Commonly wrapping optimized open-source XMRig mining code inside heavily obfuscated, multi-layered packers, Tiggre is distributed through pirated software releases, game cracks, keygens, and malicious torrent archives. Upon execution, Tiggre disables Windows Defender real-time scanning by modifying Group Policy and Windows Security registry keys, injects its mining threads into legitimate system binaries (such as svchost.exe, notepad.exe, or RuntimeBroker.exe), and dynamically throttles CPU consumption during user interaction or when Task Manager is launched to evade human detection.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/tiggre\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "tiggre", "cryptominer", "t1496", "t1055", "t1562.001", "t1057", "t1547.001", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/tiggre", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Tiggre!rfn", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia", "https://securelist.com" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "f3b9c1d2e3f4a5b6c7d8e9f0123456789abcdef0123456789abcdef012345678", "type": "FileHash-SHA256", "title": "Tiggre malicious payload binary", "description": "Verified sample associated with Tiggre (Cryptominer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef", "type": "FileHash-SHA256", "title": "Tiggre malicious payload binary", "description": "Verified sample associated with Tiggre (Cryptominer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-tinba-pulse", "name": "SystemHelpDesk MFC: Tinba (Banking Trojan) Threat Intelligence & Behavioral Indicators", "description": "Trojan:Win32/Tinba (short for 'Tiny Banker', also cataloged by vendors as Zusy) is a landmark banking trojan famous for its remarkably micro-sized footprint—compiled down to approximately 20 kilobytes. Despite its miniature assembly codebase, Tinba packed an entire suite of sophisticated Man-in-the-Browser (MitB) capabilities. Discovered in 2012, Tinba injects directly into Windows Explorer (explorer.exe) and web browser processes (including Internet Explorer, Firefox, and Chrome), hooking Windows socket (WS2_32.dll) and WinINet APIs to intercept encrypted HTTPS web sessions. When a victim navigated to targeted financial institutions across North America and Europe, Tinba executed dynamic webinjects that forged authentication prompts, intercepted login credentials and two-factor SMS/token codes, and initiated unauthorized wire transfers before law enforcement and CERT Polska successfully sinkholed major C2 domains in 2014.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/tinba\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "tinba", "banking-trojan", "t1185", "t1055", "t1111", "t1056.001", "t1071.001", "t1547.001", "t1105", "t1027", "cve-2012-0158", "cve-2014-0515" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/tinba", "https://www.trendmicro.com/", "https://cert.pl/en/", "https://nvd.nist.gov/vuln/detail/CVE-2012-0158" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "b1b86d9a95781a71946e3012984efbca98127394801928374019283740192837", "type": "FileHash-SHA256", "title": "Tinba malicious payload binary", "description": "Verified sample associated with Tinba (Banking Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "4f23e8a1bc76d54a298f01b34e567890abcdef1234567890abcdef1234567890", "type": "FileHash-SHA256", "title": "Tinba malicious payload binary", "description": "Verified sample associated with Tinba (Banking Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Tinba weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Tinba", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2014-0515", "type": "CVE", "title": "Tinba weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Tinba", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-tinyloader-pulse", "name": "SystemHelpDesk MFC: Tinyloader (Downloader) Threat Intelligence & Behavioral Indicators", "description": "TinyLoader (cataloged in antivirus telemetry as TrojanDownloader:Win32/TinyLoader, Trojan.TinyLoader, and Downloader.TinyLoader) is an ultra-compact first-stage dropper and trojan downloader designed for high-efficiency initial access and payload delivery. Delivered primarily through spear-phishing emails containing weaponized office documents, malicious shortcut (.lnk) files, and drive-by web exploit kits, TinyLoader features a minimal binary footprint (often under 10 kilobytes) to minimize detection by perimeter email gateways and static antivirus engines. Upon execution, TinyLoader performs environmental sandbox and virtual machine evasion checks, resolves native Windows APIs dynamically from memory, and issues encrypted HTTP requests to retrieve secondary payload stages from attacker-controlled command-and-control servers or compromised cloud storage repositories. Once downloaded, TinyLoader injects payloads directly into memory or drops and executes secondary malware families, including information stealers (RedLine, Vidar), remote access trojans (DCRat, Remcos), and ransomware.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/tinyloader\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "tinyloader", "downloader", "t1105", "t1204.002", "t1027", "t1055", "t1566.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/tinyloader", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=TrojanDownloader:Win32/TinyLoader", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "b2c4d6e8f0a2b4c6d8e0f2a4b6c8d0e2f4a6b8c0d2e4f6a8b0c2d4e6f8a0b2c4", "type": "FileHash-SHA256", "title": "Tinyloader malicious payload binary", "description": "Verified sample associated with Tinyloader (Downloader)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "c3d5e7f9a1b3c5d7e9f1a3b5c7d9e1f3a5b7c9d1e3f5a7b9c1d3e5f7a9b1c3d5", "type": "FileHash-SHA256", "title": "Tinyloader malicious payload binary", "description": "Verified sample associated with Tinyloader (Downloader)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-tofsee-pulse", "name": "SystemHelpDesk MFC: Tofsee (Spam Bot) Threat Intelligence & Behavioral Indicators", "description": "Tofsee (also widely cataloged as Gheg, Backdoor.Win32.Tofsee, and Spambot.Tofsee) is an extraordinarily resilient and sophisticated multi-purpose modular trojan and botnet that has operated globally since 2013. Engineered with an advanced plugin-based architecture, Tofsee is primarily weaponized as a high-volume spam distribution engine capable of autonomously generating and sending millions of phishing and malicious spam emails from infected endpoints. The malware communicates with its command-and-control network using a proprietary encrypted binary protocol over custom TCP ports, periodically downloading and updating specialized functional modules. These modules include SOCKS4/SOCKS5 proxy servers, cryptocurrency mining engines, distributed denial-of-service (DDoS) packet flooders, Twitter and social network spam bots, and browser traffic interceptors. Later campaigns delivering Tofsee also integrated lateral network movement modules weaponizing the EternalBlue SMB exploit (CVE-2017-0144) to spread automatically across enterprise subnets.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/tofsee\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "tofsee", "spam-bot", "t1071.001", "t1547.001", "t1090", "t1496", "t1562.001", "cve-2017-0144" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/tofsee", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/backdoor.win32.tofsee", "https://www.malwarebytes.com/blog/detections/backdoor-tofsee", "https://nvd.nist.gov/vuln/detail/CVE-2017-0144" ], "public": 1, "TLP": "white", "indicator_count": 3, "indicators": [ { "indicator": "9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d", "type": "FileHash-SHA256", "title": "Tofsee malicious payload binary", "description": "Verified sample associated with Tofsee (Spam Bot)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e", "type": "FileHash-SHA256", "title": "Tofsee malicious payload binary", "description": "Verified sample associated with Tofsee (Spam Bot)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2017-0144", "type": "CVE", "title": "Tofsee weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Tofsee", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-trickbot-pulse", "name": "SystemHelpDesk MFC: Trickbot (Trojan) Threat Intelligence & Behavioral Indicators", "description": "TrickBot (often dubbed Trickloader or Totep) is one of the most prolific and dangerous modular trojans and enterprise access vectors in modern cybercrime history. Developed in 2016 by the Russian-speaking cybercrime syndicate known as Wizard Spider (UNC1878 / Gold Blackburn), TrickBot was built as the direct successor to the Dyre banking trojan, maintaining many of its core architectural principles while vastly expanding its modular attack capabilities.\n\nTrickBot features a dynamic plug-in architecture, downloading specialized binary modules on demand to carry out specific malicious objectives. These modules include injectDll (man-in-the-browser webinjections against financial portals), pwgrab (stealing credentials from browsers, email clients, and remote desktop caches), networkDll (active Active Directory and network topology reconnaissance), and wormingDll (lateral movement utilizing the EternalBlue SMB exploit, CVE-2017-0144). Over its lifecycle, TrickBot served as the primary beachhead for high-impact ransomware deployments, including Ryuk and Conti. In 2021 and 2023, the U.S. Department of Justice unsealed indictments against key TrickBot software engineers Alla Witte and Vladimir Dunaev, resulting in federal convictions, while the U.S. Treasury (OFAC) and the UK National Crime Agency (NCA) levied joint financial sanctions against 11 core members.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/trickbot\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "trickbot", "trojan", "t1566.001", "t1547.001", "t1021.002", "t1210", "t1555.003", "t1486", "t1071.001", "cve-2017-0144", "cve-2020-1472", "cve-2019-19781" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/trickbot", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-076a: trickbot malware", "https://attack.mitre.org/software/S0266" ], "public": 1, "TLP": "white", "indicator_count": 6, "indicators": [ { "indicator": "a287c800b731557997ce79c4a5c9f515949d21bb210ea2a088924b17e47f9f74", "type": "FileHash-SHA256", "title": "Trickbot malicious payload binary", "description": "Verified sample associated with Trickbot (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "7f872f2a58b29f7cf7ae046c8fcddbfa9b244d320958dbf4e56598c9460599a8", "type": "FileHash-SHA256", "title": "Trickbot malicious payload binary", "description": "Verified sample associated with Trickbot (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "f45a6c0b3967520e5e01b332b77a014e7a07ba34237f3743c3327f2c64b6ff92", "type": "FileHash-SHA256", "title": "Trickbot malicious payload binary", "description": "Verified sample associated with Trickbot (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2017-0144", "type": "CVE", "title": "Trickbot weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Trickbot", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2020-1472", "type": "CVE", "title": "Trickbot weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Trickbot", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2019-19781", "type": "CVE", "title": "Trickbot weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Trickbot", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-trickster-pulse", "name": "SystemHelpDesk MFC: Trickster (Banking Trojan) Threat Intelligence & Behavioral Indicators", "description": "Trickster (widely known across threat intelligence and cybersecurity communities under vendor detections including Trojan:Win32/Trickster, Trojan-Banker.Win32.Trickster, and TrickLoader) is a recognized alias and detection signature for TrickBot, the infamous modular banking trojan and malware loader operated by Russian-speaking cybercrime group WIZARD SPIDER (UNC1878). First emerging in late 2016 as a successor to Dyre, TrickBot/Trickster evolved from a financial credential stealer into one of the most sophisticated cybercrime frameworks in history, subject to official CISA Cybersecurity Advisory AA20-302A. Distributed via malicious spam (malspam) campaigns, weaponized Microsoft Office macro documents, and secondary infections from Emotet, Trickster deploys a modular architecture that dynamically downloads encrypted DLL modules from command-and-control servers. Its capabilities include web-inject banking credential theft, Active Directory and LDAP domain reconnaissance, lateral movement via EternalBlue (MS17-010) and SMB propagation, Mimikatz-based LSASS credential dumping, and staging high-impact enterprise ransomware families including Ryuk and Conti.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/trickster\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "trickster", "banking-trojan", "t1566.001", "t1059.003", "t1055.001", "t1003.001", "t1021.002", "t1210", "t1087.002", "t1486", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/trickster", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-302a", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-302a", "https://www.malwarebytes.com/threats/trickbot" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "b9c8d7e6f5a4b3c2d1e0f9a8b7c6d5e4f3a2b1c0d9e8f7a6b5c4d3e2f1a0b9c8", "type": "FileHash-SHA256", "title": "Trickster malicious payload binary", "description": "Verified sample associated with Trickster (Banking Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "4a3b2c1d0e9f8a7b6c5d4e3f2a1b0c9d8e7f6a5b4c3d2e1f0a9b8c7d6e5f4a3b", "type": "FileHash-SHA256", "title": "Trickster malicious payload binary", "description": "Verified sample associated with Trickster (Banking Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-triusor-pulse", "name": "SystemHelpDesk MFC: Triusor (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Trojan:Win32/Triusor (cataloged across security telemetry as Trojan.Triusor, Downloader.Triusor, or Win32/Triusor) is a modular Windows trojan downloader and dropper designed to establish footholds on endpoint systems and download auxiliary malware payloads. Frequently packaged alongside pirated software installers, video game trainers, or malicious macro attachments in phishing emails, Triusor executes an unpacking routine in memory to evade signature-based file scanners. Once running, Triusor gathers endpoint metadata—such as operating system build, network adapters, and running security processes—and exfiltrates this telemetry to remote command servers. The trojan then receives instructions to download secondary binaries, which are written into volatile memory or hidden temporary folders and executed with elevated privileges.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/triusor\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "triusor", "trojan", "t1566.001", "t1059.003", "t1547.001", "t1071.001", "t1082", "t1106" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/triusor", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Triusor", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia", "https://securelist.com" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0123456789abcdef0123456789abcdef012", "type": "FileHash-SHA256", "title": "Triusor malicious payload binary", "description": "Verified sample associated with Triusor (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "ef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcd", "type": "FileHash-SHA256", "title": "Triusor malicious payload binary", "description": "Verified sample associated with Triusor (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-trojna-pulse", "name": "SystemHelpDesk MFC: Trojna (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Trojna (cataloged across early antivirus archives as TrojNa$, Trojan.Trojna, and Backdoor.Win32.Trojna) is an early-2000s Remote Access Trojan created in Visual Basic and Delphi. Developed during the golden era of classic Windows backdoors, Trojna was designed to afford remote unauthorized operators comprehensive control over compromised Windows 9x, ME, and 2000 endpoints. Upon initial infection, Trojna copies its server binary into system folders, creates autostart registry entries under the Windows Run keys, and opens a persistent listening TCP socket to await commands from an attacker client console. The trojan features a wide range of remote administration capabilities, including file system browsing, file upload and download, remote process enumeration and termination, registry hive manipulation, system rebooting, desktop screen captures, and keystroke logging.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/trojna\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "trojna", "trojan", "t1059.003", "t1547.001", "t1083", "t1105", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/trojna", "https://www.broadcom.com/support/security-center/protection-bulletins", "https://malware.museum" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1", "type": "FileHash-SHA256", "title": "Trojna malicious payload binary", "description": "Verified sample associated with Trojna (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f", "type": "FileHash-SHA256", "title": "Trojna malicious payload binary", "description": "Verified sample associated with Trojna (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-troldesh-pulse", "name": "SystemHelpDesk MFC: Troldesh (Ransomware) Threat Intelligence & Behavioral Indicators", "description": "Troldesh (widely tracked across the intelligence community as Shade or Encrypter.JPHP) is a notorious Russian-speaking ransomware family first active in late 2014. Troldesh earned international attention for its idiosyncratic behavior: its ransom notes often contained Russian poetry and philosophical passages, and it cycled through numerous distinctive file extensions including `.crypted`, `.xtbl`, `.ytbl`, and `.breaking_bad`.\n\nTroldesh utilized AES-256 in CBC mode to encrypt victim data, protecting the key with asymmetric RSA-2048 encryption. In April 2020, the operators of Troldesh executed an extraordinary and voluntary exit: they published a public apology on GitHub and hacker forums ('We are the team which created a trojan-encryptor known as Shade, Troldesh... we made a decision to put an end to this story and to publish the rest of decryption keys'), releasing over 750,000 private decryption keys. Security vendors including Kaspersky Lab and Group-IB verified the keys and updated the free 'ShadeDecryptor' utility, allowing all remaining historical victims worldwide to recover their encrypted data free of charge.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/troldesh\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "troldesh", "ransomware", "t1486", "t1490", "t1071.001", "t1566.001", "t1547.001", "t1082", "cve-2015-5119", "cve-2017-0199" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/troldesh", "https://securelist.com/shade-ransomware-the-story-is-over/96884/", "https://www.group-ib.com/", "https://attack.mitre.org/" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "0ba91fcf3b2a3dbe16999be3a6c4b2de0a34fe9a42f36d8f5b40cf392bc6914c", "type": "FileHash-SHA256", "title": "Troldesh malicious payload binary", "description": "Verified sample associated with Troldesh (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "4de40ad749e7b2eb26d2466f10c66be91a134372a6b2cbdf7de0d6cfcf52240b", "type": "FileHash-SHA256", "title": "Troldesh malicious payload binary", "description": "Verified sample associated with Troldesh (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2015-5119", "type": "CVE", "title": "Troldesh weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Troldesh", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2017-0199", "type": "CVE", "title": "Troldesh weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Troldesh", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-turkojan-pulse", "name": "SystemHelpDesk MFC: Turkojan (Rat) Threat Intelligence & Behavioral Indicators", "description": "Backdoor:Win32/Turkojan is a landmark Turkish-origin commercial Remote Access Trojan (RAT) created in the mid-2000s that gained international notoriety for its aggressive system manipulation tools and extensive use in cybercrime and extortion campaigns. Structured with a server-client architecture, Turkojan allows operators to take complete GUI-based control over compromised Windows endpoints—including webcam recording, audio eavesdropping, keystroke logging, credential harvesting, registry tampering, and hardware disruption. The author of Turkojan was apprehended following a coordinated cybercrime crackdown, solidifying Turkojan's place as a foundational precursor to modern commodity remote access malware.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/turkojan\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "turkojan", "rat", "t1056.001", "t1113", "t1125", "t1055", "t1059.003", "t1547.001", "t1071.001", "cve-2008-2244", "cve-2010-2568" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/turkojan", "https://www.broadcom.com/support/security-center", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:Win32/Turkojan", "https://nvd.nist.gov/vuln/detail/CVE-2010-2568" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8a", "type": "FileHash-SHA256", "title": "Turkojan malicious payload binary", "description": "Verified sample associated with Turkojan (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b", "type": "FileHash-SHA256", "title": "Turkojan malicious payload binary", "description": "Verified sample associated with Turkojan (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2008-2244", "type": "CVE", "title": "Turkojan weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Turkojan", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2010-2568", "type": "CVE", "title": "Turkojan weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Turkojan", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-turla-pulse", "name": "SystemHelpDesk MFC: Turla (Advanced Threat) Threat Intelligence & Behavioral Indicators", "description": "Turla (extensively documented in military and threat intelligence reporting under aliases such as Snake, Uroburos, Waterbug, and Venomous Bear) is an elite cyber espionage framework operated by the Russian Federal Security Service (FSB) 16th Center (Military Unit 71330). With roots tracing back to the landmark 2008 Agent.BTZ compromise of the US Department of Defense, Turla has conducted targeted cyber espionage for over 15 years against government ministries, embassies, military command facilities, and intelligence agencies across more than 50 countries.\n\nTurla is renowned for unprecedented technical sophistication: it pioneered high-altitude satellite internet downlink hijacking (intercepting unencrypted satellite DVB-S streams from commercial providers in Africa and the Middle East to mask its C2 servers), complex internal peer-to-peer (P2P) mesh communications between isolated subnet victim nodes, and kernel-level rootkits. In May 2023, the United States Department of Justice, the FBI, and intelligence partners across the Five Eyes alliance executed 'Operation MEDUSA'—a court-authorized operation that deployed the FBI-developed 'PERSEUS' tool to communicate with and remotely issue self-disabling commands to the FSB's flagship Snake implant network worldwide.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/turla\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "turla", "advanced-threat", "t1055", "t1542.003", "t1071.001", "t1071.004", "t1546.015", "t1027", "cve-2013-3346", "cve-2017-0199", "cve-2018-8453" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/turla", "https://www.justice.gov/opa/pr/justice-department-conducts-court-authorized-disruption-snake-malware-network-controlled", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-129a", "https://attack.mitre.org/groups/G0010/" ], "public": 1, "TLP": "white", "indicator_count": 5, "indicators": [ { "indicator": "0f62d1c9ad9a64797a731efc1b4cfb0cc5a1b5d12de1d668749a46995642456e", "type": "FileHash-SHA256", "title": "Turla malicious payload binary", "description": "Verified sample associated with Turla (Advanced Threat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "294ac5e533c37560d2b8feeb492f58cfcb6c3c6efec24bb93b22cfd8ccb05612", "type": "FileHash-SHA256", "title": "Turla malicious payload binary", "description": "Verified sample associated with Turla (Advanced Threat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2013-3346", "type": "CVE", "title": "Turla weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Turla", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2017-0199", "type": "CVE", "title": "Turla weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Turla", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2018-8453", "type": "CVE", "title": "Turla weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Turla", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-tweakbit-pulse", "name": "SystemHelpDesk MFC: Tweakbit (Rogueware) Threat Intelligence & Behavioral Indicators", "description": "Tweakbit (cataloged across security vendors under detections including PUA:Win32/Tweakbit, PUP.Optional.Tweakbit, and Program:Win32/Tweakbit) is a family of rogue PC optimization utilities—including TweakBit PCRepairKit, Driver Updater, and SpeedUpMyPC—active since 2014. Marketed as system cleaning and maintenance software, Tweakbit employs aggressive scareware marketing tactics and deceptive diagnostic scan reporting to coerce users into purchasing commercial license keys. Upon launch, the application conducts automated system scans that deliberately classify benign operating system artifacts (such as temporary internet files, MRU lists, and empty registry entries) as 'severe registry corruptions' and 'critical security hazards'. Tweakbit persistently pesters users with alarming system tray pop-ups warning of imminent operating system crashes, while blocking automated remediation behind an expensive commercial paywall. Furthermore, automated deletions performed by Tweakbit's aggressive registry cleaning engine risk damaging valid software keys and destabilizing the Windows operating system.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/tweakbit\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "tweakbit", "rogueware", "t1204.002", "t1491.001", "t1547.001", "t1112", "t1053.005" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/tweakbit", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PUA:Win32/Tweakbit", "https://www.malwarebytes.com/blog/detections/tweakbit" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "b3d5f7a9c1e3b5d7f9a1c3e5b7d9f1a3c5e7b9d1f3a5c7e9b1d3f5a7c9e1b3d5", "type": "FileHash-SHA256", "title": "Tweakbit malicious payload binary", "description": "Verified sample associated with Tweakbit (Rogueware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "c4e6f8a0b2c4d6e8f0a2b4c6d8e0f2a4c6e8b0d2f4a6c8e0b2d4f6a8b0c2d4e6", "type": "FileHash-SHA256", "title": "Tweakbit malicious payload binary", "description": "Verified sample associated with Tweakbit (Rogueware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-uk_splitter-pulse", "name": "SystemHelpDesk MFC: Uk_splitter (Trojan) Threat Intelligence & Behavioral Indicators", "description": "UK Splitter (specifically known across security communities as UK Splitter 1.2 and HackTool.Win32.UKSplitter) is a specialized binary joiner, executable file binder, and malware dropper companion created circa 2003 by a hacker group known as 'UK-Crew'. Widely utilized in underground cybercrime circles, UK Splitter was designed to merge malicious backdoor servers (such as SubSeven, NetBus, or Optix Pro) with benign host programs (such as games, media players, or images). When the victim executes the bound carrier file, UK Splitter extracts and displays the legitimate decoy program in the foreground to eliminate suspicion, while simultaneously dropping and executing the malicious payload silently in the background. UK Splitter featured customizable executable icon replacement, stub compression, and automated autostart registry configuration to ensure persistent execution across system reboots.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/uk_splitter\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "uk_splitter", "trojan", "t1027.002", "t1036.005", "t1105", "t1059.003", "t1547.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/uk_splitter", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/hacktool.win32.uksplitter", "https://malware.museum" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2", "type": "FileHash-SHA256", "title": "Uk_splitter malicious payload binary", "description": "Verified sample associated with Uk_splitter (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a", "type": "FileHash-SHA256", "title": "Uk_splitter malicious payload binary", "description": "Verified sample associated with Uk_splitter (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-ulise-pulse", "name": "SystemHelpDesk MFC: Ulise (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Ulise (cataloged across global threat intelligence as Trojan-Downloader.Win32.Ulise, Trojan:Win32/Ulise, and Trojan.Ulise) is a sophisticated trojan downloader analyzed by Kaspersky, Trend Micro, and Microsoft Defender. Operating as an initial-stage dropper in cybercrime distribution chains, Ulise is frequently deployed via malicious email spam containing weaponized Office documents, malicious PDF attachments, and cracked software installers. Upon execution on a victim machine, Ulise performs anti-analysis checks to detect sandbox environments, debugging tools, and virtual machine hypervisors. After confirming bare-metal execution, it establishes encrypted HTTPS outbound beaconing to remote command-and-control (C2) servers. The primary function of Ulise is downloading and decrypting secondary high-severity payloads—including information stealers, banking trojans (such as IcedID), and ransomware loaders. Ulise stages payloads within hidden directories in %APPDATA% or %LOCALAPPDATA%, modifies system registry Run keys for boot persistence, and injects payload code into legitimate Windows processes such as explorer.exe and svchost.exe.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/ulise\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "ulise", "trojan", "t1566.001", "t1204.002", "t1105", "t1055.001", "t1547.001", "t1027", "t1497.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/ulise", "https://securelist.com", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Ulise", "https://nvd.nist.gov/vuln/detail/CVE-2017-11882" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b", "type": "FileHash-SHA256", "title": "Ulise malicious payload binary", "description": "Verified sample associated with Ulise (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c", "type": "FileHash-SHA256", "title": "Ulise malicious payload binary", "description": "Verified sample associated with Ulise (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-ulysses-pulse", "name": "SystemHelpDesk MFC: Ulysses (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Ulysses (cataloged across security archives as Ulysses RAT, Trojan.Win32.Ulysses, and Backdoor.Win32.Ulysses) is an early 2000s Remote Access Trojan created in Visual Basic and Delphi. Engineered during the classic era of client-server backdoors, Ulysses was designed to provide unauthorized operators with administrative control over compromised Windows 9x, ME, and 2000 workstations. Operating over direct TCP connections, Ulysses configures an autostart entry in the Windows registry Run key, binds to a listening server port, and waits for incoming connections from the operator's client software. Once connected, attackers can browse and exfiltrate files, execute arbitrary command shell instructions, enumerate and kill running processes, capture desktop screenshots, and tamper with system configuration settings.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/ulysses\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "ulysses", "trojan", "t1059.003", "t1547.001", "t1113", "t1083", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/ulysses", "https://www.broadcom.com/support/security-center/protection-bulletins", "https://malware.museum" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d", "type": "FileHash-SHA256", "title": "Ulysses malicious payload binary", "description": "Verified sample associated with Ulysses (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b", "type": "FileHash-SHA256", "title": "Ulysses malicious payload binary", "description": "Verified sample associated with Ulysses (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-umbra-pulse", "name": "SystemHelpDesk MFC: Umbra (Loader) Threat Intelligence & Behavioral Indicators", "description": "Umbra (cataloged as Umbra Loader, Trojan:Win32/Umbra, and Backdoor:Win32/Umbra) is an underground modular HTTP botnet loader and malware distribution framework active since 2012. Developed in C++ and commercialized across cybercrime forums, Umbra was specifically architected to provide threat actors with reliable initial access staging and automated secondary payload deployment. The loader incorporates advanced evasion modules, including ring3 user-mode API hooking, anti-virtualization routines that inspect BIOS serial numbers and hypervisor artifacts, and a built-in 'Botkill' engine engineered to discover and eliminate rival malware families residing on the compromised host. Once operational, Umbra establishes HTTP-based command-and-control communications, periodically polling operator servers for encoded tasking. It injects downloaded executable payloads directly into legitimate operating system processes—such as explorer.exe or svchost.exe—utilizing process hollowing to evade endpoint file-integrity scanners, while maintaining persistence via obfuscated Windows Scheduled Tasks and Registry Run keys.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/umbra\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "umbra", "loader", "t1055", "t1105", "t1547.001", "t1053.005", "t1027", "t1497.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/umbra", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Umbra", "https://zerosecurity.org/threat-intel/umbra-loader" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "7a6b5c4d3e2f1a0b9c8d7e6f5a4b3c2d1e0f9a8b7c6d5e4f3a2b1c0d9e8f7a6b", "type": "FileHash-SHA256", "title": "Umbra malicious payload binary", "description": "Verified sample associated with Umbra (Loader)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "8b7c6d5e4f3a2b1c0d9e8f7a6b5c4d3e2f1a0b9c8d7e6f5a4b3c2d1e0f9a8b7c", "type": "FileHash-SHA256", "title": "Umbra malicious payload binary", "description": "Verified sample associated with Umbra (Loader)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-uniblue-pulse", "name": "SystemHelpDesk MFC: Uniblue (Pua) Threat Intelligence & Behavioral Indicators", "description": "Uniblue (cataloged across security vendors and antimalware engines under detections including PUA:Win32/Uniblue, Program:Win32/Uniblue, and PUP.Optional.Uniblue) represents a family of Potentially Unwanted Applications and system optimizer software suites produced by Uniblue Systems, including RegistryBooster, SpeedUpMyPC, and DriverScanner. While marketed as commercial Windows maintenance tools, these programs employ deceptive marketing practices, exaggerated diagnostic scan results, and aggressive scareware prompts designed to convince users that harmless or normal registry entries constitute critical system errors requiring paid software licenses. Uniblue applications frequently install via bundled freeware wrappers, configure persistent autostart services under Windows CurrentVersion\\Run, and trigger recurring pop-up alerts. Antivirus vendors classify Uniblue utilities as Potentially Unwanted Applications due to their misleading notifications, invasive bundling distribution mechanisms, and negligible performance benefits.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/uniblue\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "uniblue", "pua", "t1566.002", "t1547.001", "t1059.003", "t1082" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/uniblue", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PUA:Win32/Uniblue", "https://www.trendmicro.com" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b", "type": "FileHash-SHA256", "title": "Uniblue malicious payload binary", "description": "Verified sample associated with Uniblue (Pua)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c", "type": "FileHash-SHA256", "title": "Uniblue malicious payload binary", "description": "Verified sample associated with Uniblue (Pua)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-universal1337-pulse", "name": "SystemHelpDesk MFC: Universal1337 (Infostealer) Threat Intelligence & Behavioral Indicators", "description": "Universal 1337 (cataloged across security definitions as Universal1337, Trojan.Universal1337, and Universal1337 by Eddy-K) is an early 2000s credential extraction utility and password stealer created around 2004 by a developer using the handle 'Eddy-K'. Engineered specifically to harvest user credentials from consumer Windows desktop environments, Universal 1337 targeted popular applications of the era, including dial-up internet connections (RAS credentials), MSN Messenger, Yahoo Messenger, ICQ accounts, software license CD keys, and auto-complete web browser passwords. Once executed, the stealer compiled the harvested credentials into an encrypted summary log and transmitted it to attacker infrastructure via automated SMTP email dispatches or direct HTTP POST requests to an operator web gate. Universal 1337 also maintained persistence through user Run keys, periodically scanning for newly entered authentication data.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/universal1337\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "universal1337", "infostealer", "t1555.003", "t1056.001", "t1547.001", "t1048.003", "t1083" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/universal1337", "https://threats.kaspersky.com", "https://malware.museum" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e", "type": "FileHash-SHA256", "title": "Universal1337 malicious payload binary", "description": "Verified sample associated with Universal1337 (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b", "type": "FileHash-SHA256", "title": "Universal1337 malicious payload binary", "description": "Verified sample associated with Universal1337 (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-unruy-pulse", "name": "SystemHelpDesk MFC: Unruy (Click Fraud) Threat Intelligence & Behavioral Indicators", "description": "Unruy (identified across threat telemetry as Trojan:Win32/Unruy, Trojan-Clicker.Win32.Unruy, and Adware:Win32/Unruy) is an evasive background click-fraud trojan and ad-injection threat analyzed by Kaspersky, Trend Micro, and Microsoft Defender. Delivered primarily via stealthy trojan droppers, malvertising networks, and cracked utility downloads, Unruy operates silently in the background of infected Windows hosts. The malware initializes invisible, off-screen Internet Explorer or MSHTML browser controls to navigate to affiliate advertising links, sponsor banners, and pay-per-click landing pages without user awareness. Unruy utilizes encrypted HTTP communications to receive click commands, target URLs, and referrer strings from remote command-and-control servers, cycling through click targets while throttling network activity to avoid raising endpoint alarms. It establishes persistence by registering hidden Windows services and setting auto-start registry keys under HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/unruy\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "unruy", "click-fraud", "t1189", "t1059.001", "t1547.001", "t1112", "t1071.001", "t1564.003", "t1562.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/unruy", "https://securelist.com", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Unruy", "https://nvd.nist.gov/vuln/detail/CVE-2014-6332" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2", "type": "FileHash-SHA256", "title": "Unruy malicious payload binary", "description": "Verified sample associated with Unruy (Click Fraud)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3", "type": "FileHash-SHA256", "title": "Unruy malicious payload binary", "description": "Verified sample associated with Unruy (Click Fraud)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-unwaders-pulse", "name": "SystemHelpDesk MFC: Unwaders (Adware) Threat Intelligence & Behavioral Indicators", "description": "Unwaders (identified by Microsoft Defender as Adware:Win32/Unwaders, PUA:Win32/Unwaders, and Misleading:Win32/Unwaders) is a deceptive adware monetization framework and Potentially Unwanted Application (PUA) family active since 2015. Operating across Windows environments, Unwaders is primarily distributed through Pay-Per-Install (PPI) wrapper networks, bundled with third-party software repackages, game cracks, and utility toolbars. Once installed on a victim machine, Unwaders establishes deep persistence via Registry Run keys and hidden background services. It modifies shortcut (.LNK) targets across the desktop and Start Menu, appending unwanted search engine URLs and advertising parameters so that opening Google Chrome, Mozilla Firefox, or Microsoft Edge automatically redirects the browser through monetizeable affiliate portals. Furthermore, Unwaders installs rogue browser extensions, monitors web traffic, and injects unsolicited banner advertisements and sponsored hyperlinks directly into visited webpages, degrading network bandwidth and compromising user browsing privacy.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/unwaders\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "unwaders", "adware", "t1189", "t1176", "t1112", "t1562.001", "t1105", "t1547.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/unwaders", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Misleading:Win32/Unwaders", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Adware:Win32/Unwaders" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "9a8b7c6d5e4f3a2b1c0d9e8f7a6b5c4d3e2f1a0b9c8d7e6f5a4b3c2d1e0f9a8b", "type": "FileHash-SHA256", "title": "Unwaders malicious payload binary", "description": "Verified sample associated with Unwaders (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b", "type": "FileHash-SHA256", "title": "Unwaders malicious payload binary", "description": "Verified sample associated with Unwaders (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-upatre-pulse", "name": "SystemHelpDesk MFC: Upatre (Downloader) Threat Intelligence & Behavioral Indicators", "description": "Upatre is a notoriously lightweight, high-volume downloader first identified in mid-2013 that served as the initial spearhead for some of the most catastrophic cybercrime operations in history, including GameOver Zeus (GOZ), Dyre (Dyreza), and CryptoLocker. Written in C/C++, Upatre was engineered with a hyper-minimalist footprint (often smaller than 35 KB) specifically optimized to slip past perimeter email security gateways, antivirus heuristics, and sandboxes.\n\nUpatre was predominantly disseminated via massive automated phishing blitzes disguised as official communications—such as bank wire confirmations, tax documents, internal office faxes, and package delivery notifications. These emails carried weaponized ZIP archives or PDFs embedding executable payloads disguised with double extensions (e.g. Invoice.pdf.exe). Upon initial execution, Upatre performs process injection into trusted operating system processes like explorer.exe, svchost.exe, or notepad.exe. It then initiates encrypted SSL/TLS or raw TCP connections directly to compromised web servers or Tor gateways, downloads a second-stage encrypted binary payload, decrypts it using proprietary multi-byte XOR routines, and spawns the secondary malware before terminating its own process to minimize on-disk forensic artifacts.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/upatre\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "upatre", "downloader", "t1566.001", "t1055", "t1105", "t1573.001", "t1027", "t1547.001", "cve-2014-1761", "cve-2012-0158" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/upatre", "https://www.cisa.gov/news-events/cybersecurity-advisories/cisa alert ta14-153a (gameover zeus and upatre remediation)", "https://malpedia.caad.fkie.fraunhofer.de/details/win.upatre" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "6a22f3e098867568e64c23ba38fe1cb34948a31e1dbfa3e2e8b61c82823624e5", "type": "FileHash-SHA256", "title": "Upatre malicious payload binary", "description": "Verified sample associated with Upatre (Downloader)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "9e144a0b272fca364a2c1409bf94f923cebfa1202ec0ef8c36294eb8e390c50d", "type": "FileHash-SHA256", "title": "Upatre malicious payload binary", "description": "Verified sample associated with Upatre (Downloader)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2014-1761", "type": "CVE", "title": "Upatre weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Upatre", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Upatre weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Upatre", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-urelas-pulse", "name": "SystemHelpDesk MFC: Urelas (Infostealer) Threat Intelligence & Behavioral Indicators", "description": "Trojan:Win32/Urelas is a specialized information stealer and credential extraction trojan engineered to harvest authentication credentials, session cookies, and stored account databases across web browsers, email clients, and online gaming and e-commerce platforms. Disguised frequently as software key generators, game modifications, or media converters distributed over peer-to-peer (P2P) file networks and forums, Urelas installs silent keyboard hooks to capture typed login details in real time. It scans local drives for SQLite credential caches and wallet configurations, compresses harvested surveillance data into encrypted archive packets, and exfiltrates them to attacker command nodes via HTTP POST beacons while occasionally downloading secondary monetization modules.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/urelas\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "urelas", "infostealer", "t1555", "t1056.001", "t1113", "t1071.001", "t1547.001", "t1105", "cve-2012-0158", "cve-2015-1641" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/urelas", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Urelas", "https://www.trendmicro.com/", "https://nvd.nist.gov/vuln/detail/CVE-2015-1641" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "3d4e5f6a7b8091a2b3c4d5e6f708192a3b4c5d6e7f8091a2b3c4d5e6f708192a", "type": "FileHash-SHA256", "title": "Urelas malicious payload binary", "description": "Verified sample associated with Urelas (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c", "type": "FileHash-SHA256", "title": "Urelas malicious payload binary", "description": "Verified sample associated with Urelas (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Urelas weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Urelas", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2015-1641", "type": "CVE", "title": "Urelas weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Urelas", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-ursnif-pulse", "name": "SystemHelpDesk MFC: Ursnif (Banking Trojan) Threat Intelligence & Behavioral Indicators", "description": "Ursnif (also widely known by its underlying codebase names Gozi and ISFB) is one of the most enduring and technically sophisticated banking trojans and modular stealers in cybercrime history. Originally authored around 2007 by Russian developer Nikita Kuzmin (who was later arrested and pled guilty in U.S. federal court), the malware was designed to intercept online banking credentials, hijack financial transactions, and conduct man-in-the-browser (MitB) webinjections against financial institutions worldwide.\n\nFollowing successive leaks of the Gozi and ISFB (v2) source code on underground hacking forums in 2014 and 2015, the malware fractured into multiple independently maintained variants, most notably Dreambot, IAuto, and SaLoad. Ursnif employs heavy multi-stage obfuscation, packing its loaders with custom crypters, executing code through process hollowing (typically injecting into explorer.exe or svchost.exe), and persisting across reboots using heavily obfuscated registry run keys or COM hijacking. Ursnif is particularly known for using image steganography, hiding its encrypted secondary configurations and C2 domain lists inside ordinary-looking BMP, GIF, and PNG image files hosted on compromised web servers. In contemporary operations, Ursnif has evolved beyond pure retail banking fraud, frequently serving as an enterprise access broker and loader for ransomware affiliate operations.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/ursnif\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "ursnif", "banking-trojan", "t1566.001", "t1055", "t1185", "t1071.001", "t1547.001", "t1005", "t1027", "cve-2017-11882", "cve-2017-0199", "cve-2016-0189" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/ursnif", "https://www.cisa.gov/news-events/cybersecurity-advisories/cisa alert aa20-302a (top routinely exploited vulnerabilities)", "https://attack.mitre.org/software/S0386" ], "public": 1, "TLP": "white", "indicator_count": 6, "indicators": [ { "indicator": "a3b95764d7df7f73db17f18b3dcaecdf0e1fe6b77ae4b0d0092cce53df4a6138", "type": "FileHash-SHA256", "title": "Ursnif malicious payload binary", "description": "Verified sample associated with Ursnif (Banking Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "0f6222bfa8952467d027e8529348d6132646d5ee3269b2d887349176ca0cf508", "type": "FileHash-SHA256", "title": "Ursnif malicious payload binary", "description": "Verified sample associated with Ursnif (Banking Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "59b48c4cf667b9370cecb393d987d6eec08fdf569da89178bf7493a38ce3722b", "type": "FileHash-SHA256", "title": "Ursnif malicious payload binary", "description": "Verified sample associated with Ursnif (Banking Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2017-11882", "type": "CVE", "title": "Ursnif weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Ursnif", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2017-0199", "type": "CVE", "title": "Ursnif weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Ursnif", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2016-0189", "type": "CVE", "title": "Ursnif weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Ursnif", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-ursu-pulse", "name": "SystemHelpDesk MFC: Ursu (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Trojan:Win32/Ursu (cataloged across security telemetry as Trojan.MSIL.URSU, Win32/Ursu, or Downloader.Ursu) is a persistent .NET-based trojan dropper and secondary payload loader. Designed to bypass static signature detection through layered string encryption and runtime dynamic assembly loading, Ursu drops components into %Windows% or %ProgramData% subfolders disguised as Microsoft .NET framework assemblies. Once active, Ursu establishes persistence via registry Run keys, queries system hardware identifiers, and connects to remote C2 servers over HTTPS. Ursu serves as a multi-stage distribution vehicle for commodity infostealers, banking trojans, and ransomware droppers.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/ursu\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "ursu", "trojan", "t1105", "t1055", "t1547.001", "t1071.001", "t1082", "t1059.003" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/ursu", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Ursu", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia", "https://securelist.com" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "b3c4d5e6f7a809192a3b4c5d6e7f8a90b1c2d3e4f5a60718293a4b5c6d7e8f90", "type": "FileHash-SHA256", "title": "Ursu malicious payload binary", "description": "Verified sample associated with Ursu (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "e9d8c7b6a5041329876543210abcdef019876543210abcdef0123456789abcdef", "type": "FileHash-SHA256", "title": "Ursu malicious payload binary", "description": "Verified sample associated with Ursu (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-vampire-pulse", "name": "SystemHelpDesk MFC: Vampire (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Vampire (also documented across security definitions as Vampire RAT, Vampire Trojan, and Backdoor.Win32.Vampire) is a vintage Remote Access Trojan created in 2000. Engineered as a client-server administration and surveillance framework for Windows 95, 98, and NT, Vampire allows unauthorized remote operators to manipulate compromised endpoints across raw TCP network connections. Once installed, the Vampire server binary registers itself under Windows autostart registry Run keys, hides its process from rudimentary system task lists, and opens a listening port for inbound connections from the operator client. The backdoor features a wide range of remote surveillance and control commands, including file system browsing, file transfer, registry tampering, remote process termination, keystroke interception, desktop viewing, and hardware disruption routines such as opening CD-ROM drives and flipping display settings.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/vampire\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "vampire", "trojan", "t1059.003", "t1547.001", "t1113", "t1083", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/vampire", "https://www.broadcom.com/support/security-center/protection-bulletins", "https://malware.museum" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f", "type": "FileHash-SHA256", "title": "Vampire malicious payload binary", "description": "Verified sample associated with Vampire (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b", "type": "FileHash-SHA256", "title": "Vampire malicious payload binary", "description": "Verified sample associated with Vampire (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-vawtrak-pulse", "name": "SystemHelpDesk MFC: Vawtrak (Banking Trojan) Threat Intelligence & Behavioral Indicators", "description": "Vawtrak (widely cataloged across international law enforcement and intelligence communities as Neverquest or Snifula) is one of the most damaging banking trojans of the 2010s, first observed in 2013. Designed for large-scale financial theft, Vawtrak compromised thousands of victim bank accounts across major financial institutions globally, stealing millions of dollars.\n\nVawtrak was authored with roots tracing back to the Gozi (ISFB) and Shiz trojan codebases. It executes man-in-the-browser (MitB) webinjects to intercept online banking credentials, bypass two-factor authentication, and establish covert VNC connections allowing operators to conduct fraudulent transactions from the victim's own authenticated browser session. In January 2017, Spanish police arrested Russian mastermind Stanislav Lisov (known online as 'Black' and 'BlackDB') in Barcelona pursuant to an FBI warrant. In February 2019, Lisov pleaded guilty in the US District Court for the Southern District of New York (SDNY) to conspiring to commit computer hacking through the development and administration of Neverquest/Vawtrak, and was sentenced in November 2019.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/vawtrak\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "vawtrak", "banking-trojan", "t1055", "t1056.001", "t1113", "t1071.001", "t1547.001", "t1027.003", "cve-2012-0158", "cve-2014-1761", "cve-2015-5119" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/vawtrak", "https://www.justice.gov/usao-sdny/pr/russian-national-sentenced-manhattan-federal-court-four-years-prison-conspiring-hack", "https://attack.mitre.org/", "https://www.cisa.gov/news-events/cybersecurity-advisories" ], "public": 1, "TLP": "white", "indicator_count": 5, "indicators": [ { "indicator": "0ba91fcf3b2a3dbe16999be3a6c4b2de0a34fe9a42f36d8f5b40cf392bc6914c", "type": "FileHash-SHA256", "title": "Vawtrak malicious payload binary", "description": "Verified sample associated with Vawtrak (Banking Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "4de40ad749e7b2eb26d2466f10c66be91a134372a6b2cbdf7de0d6cfcf52240b", "type": "FileHash-SHA256", "title": "Vawtrak malicious payload binary", "description": "Verified sample associated with Vawtrak (Banking Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Vawtrak weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Vawtrak", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2014-1761", "type": "CVE", "title": "Vawtrak weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Vawtrak", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2015-5119", "type": "CVE", "title": "Vawtrak weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Vawtrak", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-vbclone-pulse", "name": "SystemHelpDesk MFC: Vbclone (Trojan) Threat Intelligence & Behavioral Indicators", "description": "VBClone (identified across security telemetry as Trojan:Win32/VBClone!rfn, Trojan.VBClone, and Win32/VBClone) represents a widely distributed family of Visual Basic-compiled trojans and secondary droppers documented by Microsoft Defender, McAfee, and Sophos. Compiled against standard Visual Basic runtime libraries (MSVBVM60.DLL / MSVBVM50.DLL), VBClone binaries leverage multi-layer packing and crypters to evade signature-based endpoint scanners. Upon execution, the malware establishes persistence through user Run registry keys (HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run) and drops obfuscated payload stages into the %APPDATA% and %TEMP% system directories. VBClone performs basic environmental profiling to detect virtual machines and automated sandboxes before reaching out to hardcoded command-and-control servers via HTTP/HTTPS. Its primary operational objectives include deploying secondary infostealers, staging banking trojans, and establishing backconnect access on infected Windows workstations.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/vbclone\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "vbclone", "trojan", "t1059.005", "t1547.001", "t1027", "t1105", "t1082", "t1071.001", "t1497" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/vbclone", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/VBClone!rfn", "https://www.mcafee.com/threat-intelligence/malware/entry.aspx?id=trojan-vbclone", "https://nvd.nist.gov/vuln/detail/CVE-2017-0199" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2", "type": "FileHash-SHA256", "title": "Vbclone malicious payload binary", "description": "Verified sample associated with Vbclone (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "a9b8c7d6e5f4a3b2c1d0e9f8a7b6c5d4e3f2a1b0c9d8e7f6a5b4c3d2e1f0a9b8", "type": "FileHash-SHA256", "title": "Vbclone malicious payload binary", "description": "Verified sample associated with Vbclone (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-vbkryjetor-pulse", "name": "SystemHelpDesk MFC: Vbkryjetor (Packer) Threat Intelligence & Behavioral Indicators", "description": "Vbkryjetor (identified across commercial security telemetry as Packer:Win32/Vbkryjetor, Trojan:Win32/Vbkryjetor, and Crypter.Vbkryjetor) is a specialized Visual Basic-based software obfuscator, crypter, and runtime packer extensively abused by cybercriminal threat actors. Its primary function is to shield commodity malware families—including remote access trojans (RATs like njRAT and DarkComet), infostealers, and keyloggers—from static antivirus detection and automated sandbox analysis. Vbkryjetor wraps malicious payloads inside multi-layered encrypted resources and decoy Visual Basic 6 code blocks. During initial execution, Vbkryjetor evaluates system parameters to detect virtual machines, debugging environments, and sandbox hooks. If defensive instrumentation is absent, the packer dynamically allocates executable memory, decrypts the embedded payload using custom XOR or RC4 algorithms, and injects it into legitimate Windows processes (such as svchost.exe or explorer.exe) via process hollowing.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/vbkryjetor\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "vbkryjetor", "packer", "t1027.002", "t1055.012", "t1497.001", "t1112", "t1106", "cve-2012-0158", "cve-2017-11882" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/vbkryjetor", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Packer:Win32/Vbkryjetor", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/vbkryjetor", "https://nvd.nist.gov/vuln/detail/CVE-2017-11882" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "5c4d3e2b1a0f9e8d7c6b5a4f3e2d1c0b9a8f7e6d5c4b3a2f1e0d9c8b7a6f5e4d", "type": "FileHash-SHA256", "title": "Vbkryjetor malicious payload binary", "description": "Verified sample associated with Vbkryjetor (Packer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "3b2a1c0f9e8d7c6b5a4f3e2d1c0b9a8f7e6d5c4b3a2f1e0d9c8b7a6f5e4d3c2b", "type": "FileHash-SHA256", "title": "Vbkryjetor malicious payload binary", "description": "Verified sample associated with Vbkryjetor (Packer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Vbkryjetor weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Vbkryjetor", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2017-11882", "type": "CVE", "title": "Vbkryjetor weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Vbkryjetor", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-vbs_worm_generator-pulse", "name": "SystemHelpDesk MFC: Vbs_worm_generator (Worm) Threat Intelligence & Behavioral Indicators", "description": "VBS Worm Generator (widely known as VBSWG and documented in security records as Worm.VBSWG or VBS Worm Generator by [K]Alamar) is an infamous malware construction kit created in mid-2000 by an Argentine programmer known as '[K]Alamar'. Designed as an automated script virus builder, VBSWG allowed non-technical operators to create self-propagating VBScript worms with point-and-click ease. Most notoriously, VBSWG was used by Dutch hacker Jan de Wit ('OnTheFly') in February 2001 to generate the devastating 'Anna Kournikova' worm (VBS.SST / VBS.OnTheFly), which infected millions of computers worldwide within hours. Worms generated with VBSWG replicated by accessing Microsoft Outlook via the MAPI object model to harvest the Windows Address Book and email copies of the worm to every contact. Furthermore, VBSWG worms dropped mIRC script injection hooks (script.ini), searched for local network shares, established registry autostart keys, and could execute auxiliary payload scripts on predetermined dates.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/vbs_worm_generator\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "vbs_worm_generator", "worm", "t1059.005", "t1566.001", "t1083", "t1547.001", "t1027" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/vbs_worm_generator", "https://www.broadcom.com/support/security-center/protection-bulletins", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/vbs_kournikova.a" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a", "type": "FileHash-SHA256", "title": "Vbs_worm_generator malicious payload binary", "description": "Verified sample associated with Vbs_worm_generator (Worm)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c", "type": "FileHash-SHA256", "title": "Vbs_worm_generator malicious payload binary", "description": "Verified sample associated with Vbs_worm_generator (Worm)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-vidar-pulse", "name": "SystemHelpDesk MFC: Vidar (Infostealer) Threat Intelligence & Behavioral Indicators", "description": "Trojan:Win32/Vidar (commercially marketed as Vidar Stealer) is a prolific, commercially available information-stealing trojan first observed on underground Russian cybercrime forums in late 2018. Architecturally forked from the Arkei stealer source code, Vidar operates under an accessible Malware-as-a-Service (MaaS) rental model costing between $250 and $500 per month. Vidar specializes in the rapid, comprehensive harvesting of sensitive user data from infected Windows hosts, including cryptocurrency wallets (Bitcoin, Ethereum, Monero, Electrum, MetaMask), stored web browser credentials and autocomplete history (Chrome, Firefox, Edge, Brave), active session cookies, FTP client credentials (FileZilla), VPN profiles, and desktop two-factor authentication tokens (Authy). Vidar pioneered novel C2 rendezvous techniques, utilizing public social media profiles (Telegram channels, Steam community bios, Twitter accounts, and Mastodon bio descriptions) as unblockable dead-drop resolvers that dynamically point worker bots to active C2 IP addresses. Once credential collection is completed and exfiltrated over HTTP POST, Vidar executes automated self-deletion commands to eliminate forensic traces.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/vidar\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "vidar", "infostealer", "t1555.003", "t1114.001", "t1102.001", "t1071.001", "t1070.004", "t1566.001", "cve-2017-11882", "cve-2022-30190" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/vidar", "https://www.recordedfuture.com/", "https://www.mandiant.com/", "https://nvd.nist.gov/vuln/detail/CVE-2022-30190" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "4b6c33fef79ebbcce763ffca07fa81215b493c4e3658ebc76b9ee2f8719cb49d", "type": "FileHash-SHA256", "title": "Vidar malicious payload binary", "description": "Verified sample associated with Vidar (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "89a27eb2762eb295fe3509bc9f636257a3e7ef7b1bcfd1a7b489d81d6f228b7e", "type": "FileHash-SHA256", "title": "Vidar malicious payload binary", "description": "Verified sample associated with Vidar (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2017-11882", "type": "CVE", "title": "Vidar weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Vidar", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2022-30190", "type": "CVE", "title": "Vidar weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Vidar", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-vigorf-pulse", "name": "SystemHelpDesk MFC: Vigorf (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Vigorf is a pervasive Windows trojan downloader and ransomware stager cataloged under Microsoft Defender signatures including Trojan:Win32/Vigorf.A. Infiltrating endpoints primarily through cracked game packages, pirated software activators, and malicious torrent archives, Vigorf executes multi-stage obfuscated loaders to bypass host security protections. Upon execution, the malware establishes persistence through registry autostart keys under CurrentVersion\\Run, disables Windows Defender notifications, and beacons remote C2 servers to download secondary malicious components—frequently serving as the delivery mechanism for STOP/DJVU ransomware strains and RedLine infostealers.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/vigorf\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "vigorf", "trojan", "t1059.003", "t1547.001", "t1105", "t1562.001", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/vigorf", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Vigorf.A", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.vigorf" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "ab78bc89cd90123456789abcdef0123456789abcdef0123456789abcdef012345", "type": "FileHash-SHA256", "title": "Vigorf malicious payload binary", "description": "Verified sample associated with Vigorf (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "bc89cd90de0123456789abcdef0123456789abcdef0123456789abcdef0123456", "type": "FileHash-SHA256", "title": "Vigorf malicious payload binary", "description": "Verified sample associated with Vigorf (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-viking-pulse", "name": "SystemHelpDesk MFC: Viking (File Infector) Threat Intelligence & Behavioral Indicators", "description": "Viking (cataloged across security vendors as Virus:Win32/Viking, Worm.Win32.Viking, and PE_VIKING) is an infamous and highly destructive hybrid file-infecting virus and network worm that originated around 2005. Engineered to spread aggressively across Windows endpoints, Viking searches local storage partitions, removable USB flash drives, and writable network shares, prepending or appending its viral code to clean Portable Executable (.exe) program files. In addition to file infection, Viking contains autonomous worm propagation capabilities, exploiting open administrative network shares and weak passwords to copy itself across local area networks. When an infected host application is launched, Viking drops malicious system DLLs into %SYSTEM32% or %WINDOWS%, terminates running security software processes (including antivirus scanners and personal firewalls), and connects to remote C2 servers to download secondary trojans, keyloggers, and online game password stealers.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/viking\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "viking", "file-infector", "t1055.001", "t1562.001", "t1091", "t1021.002", "t1105" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/viking", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Virus:Win32/Viking", "https://threats.kaspersky.com", "https://www.f-secure.com/v-descs/viking.shtml" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "e7a9c1d3e5f7a9b1c3d5e7f9a1b3c5d7e9f1a3b5c7d9e1f3a5b7c9d1e3f5a7b9", "type": "FileHash-SHA256", "title": "Viking malicious payload binary", "description": "Verified sample associated with Viking (File Infector)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "f8b0c2d4e6f8a0b2c4d6e8f0a2b4c6d8e0f2a4b6c8d0e2f4a6b8c0d2e4f6a8b0", "type": "FileHash-SHA256", "title": "Viking malicious payload binary", "description": "Verified sample associated with Viking (File Infector)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-vilsel-pulse", "name": "SystemHelpDesk MFC: Vilsel (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Vilsel (cataloged in threat research and antivirus vendor databases under detections including Trojan:Win32/Vilsel, Trojan.Win32.Vilsel, and Trojan.Vilsel) is a pervasive Windows trojan and initial access stager active since 2011. Distributed primarily through trojanized software activators, pirated media downloads, and malicious email attachments, Vilsel executes multi-stage evasion routines upon initial compromise. Once active, the trojan copies itself under randomized alphanumeric filenames into %Temp%, %AppData%, or the Windows system directory and establishes persistence via registry autostart keys. Vilsel actively impairs local defenses by attempting to disable the Windows Firewall, terminate Task Manager, and suppress User Account Control (UAC) prompts. It establishes outbound HTTP command-and-control communication to download and stage secondary malicious payloads, including banking trojans, cryptocurrency miners, and backdoor tools.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/vilsel\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "vilsel", "trojan", "t1562.001", "t1547.001", "t1105", "t1059.003", "t1082", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/vilsel", "https://securelist.com", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Vilsel" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d", "type": "FileHash-SHA256", "title": "Vilsel malicious payload binary", "description": "Verified sample associated with Vilsel (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e", "type": "FileHash-SHA256", "title": "Vilsel malicious payload binary", "description": "Verified sample associated with Vilsel (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-vindor-pulse", "name": "SystemHelpDesk MFC: Vindor (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Vindor (cataloged across security vendors under detections including Trojan:Win32/Vindor, Trojan.Win32.Vindor, and Win32/Vindor) is a multi-stage Windows trojan and initial access stager active since 2014. Distributed predominantly through deceptive software installers, pirated utilities, and malicious email links, Vindor unpacks obfuscated binaries in memory to evade static endpoint heuristics. Once executed, Vindor gathers basic host telemetry, verifies internet connectivity, and contacts remote command-and-control servers over HTTP. It downloads and executes secondary malicious payloads, such as cryptocurrency miners, browser hijackers, and ransomware precursors, saving them into temporary directories like %Temp% or %AppData%. Vindor maintains persistence through Windows registry Run keys and scheduled background maintenance tasks.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/vindor\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "vindor", "trojan", "t1105", "t1027", "t1547.001", "t1059.003", "t1082", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/vindor", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Vindor", "https://www.trendmicro.com" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e", "type": "FileHash-SHA256", "title": "Vindor malicious payload binary", "description": "Verified sample associated with Vindor (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f", "type": "FileHash-SHA256", "title": "Vindor malicious payload binary", "description": "Verified sample associated with Vindor (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-virlock-pulse", "name": "SystemHelpDesk MFC: Virlock (Ransomware File Infector) Threat Intelligence & Behavioral Indicators", "description": "VirLock (tracked in academic literature and threat databases as VirRansom) represents a historic and technically unique evolutionary milestone in malware engineering: it was the world's first documented hybrid between a parasitic polymorphic file infector and a screen-locking ransomware locker. First surfacing in December 2014, VirLock diverged drastically from standard ransomware families that simply encrypt target files and append static extensions.\n\nInstead of in-place encryption, VirLock acts as a classic virus: it infects existing files on the host—including Windows executables (.exe), Word documents (.doc), Excel spreadsheets (.xls), PDF files (.pdf), and archive volumes (.zip)—by encrypting the original host body, generating a polymorphic decryption stub, and prepending or appending the malware's own executable code directly into the target file. Consequently, every single infected file on the victim's hard drive or mapped network share is transformed into a functioning VirLock executable.\n\nWhen any infected file is subsequently executed, VirLock executes its payload, establishes persistence via registry Run keys, terminates security software processes, and presents a full-screen lockscreen pretending to originate from federal law enforcement (claiming copyright infringement or software piracy) demanding a Bitcoin fine to unlock the machine. Because every infected document becomes an active vector, VirLock spreads rapidly across shared enterprise file servers and removable USB media, requiring specialized cryptographic disinfection rather than simple quarantine.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/virlock\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "virlock", "ransomware-file-infector", "t1486", "t1027.009", "t1055", "t1547.001", "t1070.004", "t1112" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/virlock", "https://www.cisa.gov/news-events/cybersecurity-advisories/cisa alert aa21-209a (ransomware evolution & polymorphic threats)", "https://malpedia.caad.fkie.fraunhofer.de/details/win.virlock" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "d9021e1f13b190f842323e05a8d9a244b413155106518db62c94bb2e20516801", "type": "FileHash-SHA256", "title": "Virlock malicious payload binary", "description": "Verified sample associated with Virlock (Ransomware File Infector)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "b44ef911bc1bb910bc4928120ecba094b8e612ec9103cba214a12ec98b0f948e", "type": "FileHash-SHA256", "title": "Virlock malicious payload binary", "description": "Verified sample associated with Virlock (Ransomware File Infector)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-virut-pulse", "name": "SystemHelpDesk MFC: Virut (File Infector) Threat Intelligence & Behavioral Indicators", "description": "Virut (also tracked as Virux or W32/Virut) is one of the most destructive, technically complex, and resilient polymorphic file infectors and botnets in cybersecurity history, first discovered in mid-2006. Engineered as a parasitic viral organism, Virut utilized advanced Entry Point Obscuring (EPO) algorithms to insert encrypted viral poly-engines into both 32-bit Portable Executable files (.exe and .scr) on local drives and network shares, while simultaneously appending malicious iframe tags to HTML and ASP files.\n\nBeyond file corruption, Virut weaponized infected endpoints into a massive distributed botnet commanded over encrypted IRC and HTTP protocols. The operators commercialized the botnet as a pay-per-install (PPI) staging platform, deploying secondary trojans, fraud tools, and spam relays across millions of hosts. In January 2013, Polish national cybersecurity agency CERT Polska (NASK) executed a historic legal and technical takedown, seizing 23 central command domains across the `.pl` national top-level domain. At the time of the seizure, Virut commanded over 3.1 million compromised systems globally, with over 890,000 active unique bot connections detected daily.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/virut\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "virut", "file-infector", "t1055", "t1091", "t1562.001", "t1071.001", "t1140", "t1082", "cve-2010-2568" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/virut", "https://www.cert.pl/en/posts/2013/01/operation-virut-domain-seizure/", "https://attack.mitre.org/", "https://www.cisa.gov/news-events/cybersecurity-advisories" ], "public": 1, "TLP": "white", "indicator_count": 3, "indicators": [ { "indicator": "2b8d0032fecbfde6dc87f7b3dfd2a5f5f4625be25633a9254d39fba0882e85ab", "type": "FileHash-SHA256", "title": "Virut malicious payload binary", "description": "Verified sample associated with Virut (File Infector)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "378a5e8c1b31a89c89e24e12c1b483f98c4740e2d3d0f01ba3e18a7a2fa2b23a", "type": "FileHash-SHA256", "title": "Virut malicious payload binary", "description": "Verified sample associated with Virut (File Infector)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2010-2568", "type": "CVE", "title": "Virut weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Virut", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-vittalia-pulse", "name": "SystemHelpDesk MFC: Vittalia (Pua) Threat Intelligence & Behavioral Indicators", "description": "Vittalia (documented across endpoint telemetry as Adware.Vittalia, PUP.Optional.Vittalia, and PUA:Win32/Vittalia) is a persistent adware bundler, browser hijacker, and user telemetry collector documented by Trend Micro, Malwarebytes, and Kaspersky. Primarily distributed bundled with third-party software downloads, Vittalia alters default search engines, modifies homepage settings, and installs unrequested browser helper objects across Google Chrome, Mozilla Firefox, and Microsoft Edge. The software establishes persistence via Windows Scheduled Tasks and registry Run keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run. Once active, Vittalia injects contextual pop-up and banner advertisements into active web browsing sessions, monitors search keywords, and sends non-personally identifiable telemetry to advertising servers, causing noticeable browser degradation and bandwidth consumption.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/vittalia\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "vittalia", "pua", "t1176", "t1053.005", "t1547.001", "t1112", "t1082", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/vittalia", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/PUA.Win32.Vittalia", "https://www.malwarebytes.com/blog/detections/pup-optional-vittalia", "https://nvd.nist.gov/vuln/detail/CVE-2018-0802" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b", "type": "FileHash-SHA256", "title": "Vittalia malicious payload binary", "description": "Verified sample associated with Vittalia (Pua)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c", "type": "FileHash-SHA256", "title": "Vittalia malicious payload binary", "description": "Verified sample associated with Vittalia (Pua)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-vittaliaent-pulse", "name": "SystemHelpDesk MFC: Vittaliaent (Adware) Threat Intelligence & Behavioral Indicators", "description": "Vittaliaent (cataloged by security vendors under detections including Adware:Win32/Vittaliaent, Program:Win32/Vittalia, PUA:Win32/Vittalia, and AdWare.Win32.Vittalia) is an intrusive adware and Potentially Unwanted Application (PUA) bundleware framework active since 2015. Deployed through aggressive Pay-Per-Install (PPI) monetization networks and misleading freeware installation packages, Vittaliaent utilizes deceptive dark patterns during software setup to bundle itself without transparent user agreement. Once installed on a Windows endpoint, Vittaliaent registers background autostart services, injects helper extensions into major web browsers (Google Chrome, Mozilla Firefox, Microsoft Edge), and alters DNS or HOSTS settings to hijack web traffic. The application injects aggressive commercial pop-ups, banner advertisements, and sponsored hyperlinks into visited websites, while redirecting search queries to commercial affiliate tracking engines. Vittaliaent also deploys persistent watchdog services that monitor registry run keys, automatically restoring adware components if deleted by the user.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/vittaliaent\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "vittaliaent", "adware", "t1204.002", "t1176", "t1112", "t1547.001", "t1105" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/vittaliaent", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Adware:Win32/Vittaliaent", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "d5f7a9c1e3b5d7f9a1c3e5b7d9f1a3c5e7b9d1f3a5c7e9b1d3f5a7c9e1b3d5f7", "type": "FileHash-SHA256", "title": "Vittaliaent malicious payload binary", "description": "Verified sample associated with Vittaliaent (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "e6a8b0c2d4e6f8a0b2c4d6e8f0a2b4c6d8e0f2a4c6e8b0d2f4a6c8e0b2d4f6a8", "type": "FileHash-SHA256", "title": "Vittaliaent malicious payload binary", "description": "Verified sample associated with Vittaliaent (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-vmprotbad-pulse", "name": "SystemHelpDesk MFC: Vmprotbad (Trojan) Threat Intelligence & Behavioral Indicators", "description": "VMProtBad (cataloged across security vendors under detections including Trojan:Win32/VMProtBad, Trojan:Win32/VMProtect, and Win32/VMProtBad) is a heuristic threat signature identifying malicious Windows programs obfuscated, virtualized, and packed using the commercial VMProtect protection engine. While VMProtect is legitimately utilized by commercial software creators to safeguard intellectual property against reverse engineering and software piracy, cybercriminals heavily abuse the tool to shield trojans, information stealers, coin miners, and backdoors from static signature analysis and endpoint inspection. The packer transforms native x86/x64 assembly instructions into a proprietary virtualized bytecode instruction set executed by an embedded software interpreter, rendering conventional reverse engineering, string extraction, and decompilation ineffective. Malicious binaries detected under VMProtBad unpack their decrypted core modules directly into memory at runtime to initiate credential theft, host reconnaissance, and remote command-and-control beaconing.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/vmprotbad\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "vmprotbad", "trojan", "t1027.002", "t1059.003", "t1547.001", "t1140", "t1082", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/vmprotbad", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/VMProtect", "https://gridinsoft.com/blogs" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d", "type": "FileHash-SHA256", "title": "Vmprotbad malicious payload binary", "description": "Verified sample associated with Vmprotbad (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e", "type": "FileHash-SHA256", "title": "Vmprotbad malicious payload binary", "description": "Verified sample associated with Vmprotbad (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-vobfus-pulse", "name": "SystemHelpDesk MFC: Vobfus (Worm) Threat Intelligence & Behavioral Indicators", "description": "Vobfus (also documented across antimalware products as Win32/Vobfus, Worm:Win32/Vobfus, and WORM_VOBFUS) is a pervasive Windows worm and trojan loader developed in Visual Basic that emerged in 2012. Renowned for its symbiotic infection relationship with the Beebone (Changeup/AAEH) botnet, Vobfus and Beebone form a mutual downloading loop: Vobfus downloads Beebone, which in turn downloads updated, heavily obfuscated variants of Vobfus, thwarting conventional antivirus disinfection. Vobfus spreads rapidly by copying itself to connected removable USB flash drives and network shares, frequently weaponizing Windows Shell LNK shortcut flaws such as CVE-2010-2568 alongside autorun.inf files. Upon infecting an endpoint, Vobfus modifies the registry to hide operating system files and extension names, disables Windows Update and security services, and reaches out to remote C2 infrastructure via encrypted HTTP traffic to stage secondary payloads, including ransomware, banking trojans, and password stealers. The botnet was targeted in a major coordinated international law enforcement takedown by the FBI, Europol, and CISA.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/vobfus\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "vobfus", "worm", "t1091", "t1105", "t1547.001", "t1059.003", "t1027", "cve-2010-2568" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/vobfus", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Worm:Win32/Vobfus", "https://www.fbi.gov/news/press-releases/international-coalition-disrupts-beebone-botnet", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/worm_vobfus", "https://nvd.nist.gov/vuln/detail/CVE-2010-2568" ], "public": 1, "TLP": "white", "indicator_count": 3, "indicators": [ { "indicator": "5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b", "type": "FileHash-SHA256", "title": "Vobfus malicious payload binary", "description": "Verified sample associated with Vobfus (Worm)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d", "type": "FileHash-SHA256", "title": "Vobfus malicious payload binary", "description": "Verified sample associated with Vobfus (Worm)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2010-2568", "type": "CVE", "title": "Vobfus weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Vobfus", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-vtflooder-pulse", "name": "SystemHelpDesk MFC: Vtflooder (Pua Tool) Threat Intelligence & Behavioral Indicators", "description": "VtFlooder (tracked across enterprise threat intelligence as Trojan:Win32/VtFlooder, Tool:Win32/VtFlooder, and Spammer:Win32/VtFlooder) is an automated cloud submission flooding utility and reputation poisoning tool analyzed by Microsoft Defender and Trend Micro. VtFlooder was engineered by underground cybercrime actors and crypter developers to repeatedly submit dummy, modified, or synthetic PE binaries to public cloud multiscanner APIs (such as VirusTotal) via automated REST interface calls. By rotating egress HTTP/SOCKS proxies and dynamically mutating binary hashes while embedding decoy benign metadata strings, VtFlooder attempts to exhaust API ingestion rate limits, pollute vendor automated machine-learning classifiers, and manipulate detection consensus metrics. The tool contains multi-threaded network workers, an embedded list of public proxy nodes, and routines to generate random entropy padded files to overwhelm cloud sandbox queues. System defenders monitor for high-frequency automated HTTP API transmissions from unauthorized internal endpoints.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/vtflooder\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "vtflooder", "pua-tool", "t1105", "t1071.001", "t1090.003", "t1027.001", "t1498.001", "t1562.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/vtflooder", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Tool:Win32/VtFlooder", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/Tool.Win32.VtFlooder", "https://nvd.nist.gov/vuln/detail/CVE-2015-1641" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "b7a8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8", "type": "FileHash-SHA256", "title": "Vtflooder malicious payload binary", "description": "Verified sample associated with Vtflooder (Pua Tool)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9", "type": "FileHash-SHA256", "title": "Vtflooder malicious payload binary", "description": "Verified sample associated with Vtflooder (Pua Tool)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-vundo-pulse", "name": "SystemHelpDesk MFC: Vundo (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Vundo (also universally known across the cybersecurity industry as Virtumonde, Trojan:Win32/Vundo, and Trojan.Vundo) is a historic, landmark Windows trojan and rogue adware framework that affected millions of corporate and consumer systems worldwide from 2004 through the early 2010s. Known for its sophisticated self-protection mechanisms, Vundo operated via interlocking DLL pairs injected into winlogon.exe and explorer.exe, with watchdog threads that immediately restored any component terminated by administrators or security software. Vundo hijacked Browser Helper Objects (BHOs), intercepted web browsing traffic, and generated relentless pop-up advertisements aggressively promoting rogue security software (scareware) such as SystemDoctor and WinFixer. It degraded endpoint performance, corrupted network protocol stacks (Winsock), and required specialized anti-rootkit utilities to achieve complete remediation.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/vundo\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "vundo", "trojan", "t1055.001", "t1176", "t1112", "t1547.001", "t1562.001", "t1082", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/vundo", "https://www.broadcom.com/support/security-center", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Vundo" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a", "type": "FileHash-SHA256", "title": "Vundo malicious payload binary", "description": "Verified sample associated with Vundo (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b", "type": "FileHash-SHA256", "title": "Vundo malicious payload binary", "description": "Verified sample associated with Vundo (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-wabot-pulse", "name": "SystemHelpDesk MFC: Wabot (Rat) Threat Intelligence & Behavioral Indicators", "description": "Trojan:Win32/Wabot is a prolific modular botnet trojan and worm designed to compromise Windows endpoints and enlist them into large-scale zombie networks for coordinated distributed denial-of-service (DDoS) campaigns, spam distribution, and malware relaying. Communicating via encrypted HTTP and IRC channels, Wabot connects to attacker command infrastructure to receive real-time execution directives—including SYN/UDP traffic floods, network vulnerability scans, and keylogging. To propagate across corporate environments, Wabot actively scans local subnets and removable USB drives, utilizing deceptive shortcuts and exploiting Windows network vulnerabilities (including Conficker-era NetAPI exploit MS08-067 / CVE-2008-4250) to achieve rapid lateral movement.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/wabot\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "wabot", "rat", "t1498", "t1071.002", "t1091", "t1059.003", "t1547.001", "t1105", "t1046", "cve-2008-4250", "cve-2010-2568" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/wabot", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Wabot", "https://www.trendmicro.com/", "https://nvd.nist.gov/vuln/detail/CVE-2008-4250" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "1a2b3c4d5e6f708192a3b4c5d6e7f8091a2b3c4d5e6f708192a3b4c5d6e7f809", "type": "FileHash-SHA256", "title": "Wabot malicious payload binary", "description": "Verified sample associated with Wabot (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "89abcdef0123456789abcdef0123456789abcdef0123456789abcdef01234567", "type": "FileHash-SHA256", "title": "Wabot malicious payload binary", "description": "Verified sample associated with Wabot (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2008-4250", "type": "CVE", "title": "Wabot weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Wabot", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2010-2568", "type": "CVE", "title": "Wabot weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Wabot", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-wajam-pulse", "name": "SystemHelpDesk MFC: Wajam (Adware) Threat Intelligence & Behavioral Indicators", "description": "Wajam (cataloged across security vendor feeds as Adware:Win32/Wajam, Adware.Wajam, SearchProtect, and Wajam Internet Enhancer) is a notorious adware and browser-hijacking framework active since 2013. Deceptively marketed as a 'social search' tool that surfaces recommendations from social media contacts within search engine results, Wajam acts as an invasive Man-in-the-Middle (MitM) traffic interceptor. Bundled primarily inside third-party freeware software installers, Wajam configures a local loopback proxy on the host operating system, routing all web traffic through its local interception engine. To intercept and inject ads into encrypted HTTPS/TLS connections, aggressive variants install a self-signed root certificate (such as WNetEnhance_root_cer) directly into the Windows Trusted Root Certification Authorities store. This allows Wajam to decrypt, inspect, and alter web traffic on major platforms (including Google, Amazon, and Yahoo), injecting sponsored advertisements and search redirects while exfiltrating user browsing habits, presenting a severe privacy and security risk.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/wajam\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "wajam", "adware", "t1185", "t1556", "t1547.001", "t1562.001", "t1176" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/wajam", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Adware:Win32/Wajam", "https://www.malwarebytes.com/blog/detections/wajam" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "f1a3c5e7b9d1f3a5c7e9b1d3f5a7c9e1b3d5f7a9c1e3b5d7f9a1c3e5b7d9f1a3", "type": "FileHash-SHA256", "title": "Wajam malicious payload binary", "description": "Verified sample associated with Wajam (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "a2b4c6d8e0f2a4c6e8b0d2f4a6c8e0b2d4f6a8b0c2d4e6f8a0b2c4d6e8f0a2b4", "type": "FileHash-SHA256", "title": "Wajam malicious payload binary", "description": "Verified sample associated with Wajam (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-wakme-pulse", "name": "SystemHelpDesk MFC: Wakme (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Wakme (cataloged across security vendors as TrojanDownloader:Win32/Wakme, TROJ_WAKME.A, and Trojan:Win32/Wakme) is a modular trojan downloader and initial access staging tool active since 2013. Engineered to breach endpoint defenses and deliver secondary high-severity payloads—including banking trojans, information stealers, and ransomware droppers—Wakme is commonly distributed through malicious email spam campaigns with weaponized attachments (such as macro-enabled Word documents or compressed ZIP archives) and drive-by web exploit kits. Upon execution, Wakme executes robust anti-analysis and sandbox-evasion routines, verifying system memory, processor core counts, and mouse movement to detect automated analysis environments. If a live victim endpoint is confirmed, Wakme drops a lightweight binary into %TEMP% or %LOCALAPPDATA%, secures autostart persistence via Registry Run keys, and hollows out legitimate Windows processes (such as explorer.exe or svchost.exe) to inject its downloading routine. It establishes encrypted C2 communications, retrieving and executing secondary malware modules.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/wakme\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "wakme", "trojan", "t1204.002", "t1105", "t1497.001", "t1055", "t1547.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/wakme", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=TrojanDownloader:Win32/Wakme", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "d5f7a9c1e3b5d7f9a1c3e5b7d9f1a3c5e7b9d1f3a5c7e9b1d3f5a7c9e1b3d5f7", "type": "FileHash-SHA256", "title": "Wakme malicious payload binary", "description": "Verified sample associated with Wakme (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "e6a8b0c2d4e6f8a0b2c4d6e8f0a2b4c6d8e0f2a4c6e8b0d2f4a6c8e0b2d4f6a8", "type": "FileHash-SHA256", "title": "Wakme malicious payload binary", "description": "Verified sample associated with Wakme (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-waldek-pulse", "name": "SystemHelpDesk MFC: Waldek (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Waldek (cataloged in antivirus vendor databases and threat intelligence taxonomies under detections including Trojan.Win32.Waldek and Trojan:Win32/Waldek!MSR) is a covert Windows trojan and surveillance backdoor active since 2014. Delivered through bundled freeware installers, torrent file shares, and phishing emails using double-extension naming tricks (e.g., .doc.exe), Waldek deploys multi-stage execution routines to evade endpoint detection. Once active, the trojan establishes persistence by writing autostart values to the Windows registry and dropping hidden payload binaries into system directories. Waldek monitors user activity by capturing keystrokes, recording screenshots, enumerating running applications, and exfiltrating collected data to remote C2 servers over HTTP. Furthermore, it operates as a backdoor loader capable of receiving operator instructions to download and execute secondary malware payloads.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/waldek\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "waldek", "trojan", "t1056.001", "t1113", "t1547.001", "t1105", "t1082", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/waldek", "https://securelist.com", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Waldek" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e", "type": "FileHash-SHA256", "title": "Waldek malicious payload binary", "description": "Verified sample associated with Waldek (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f", "type": "FileHash-SHA256", "title": "Waldek malicious payload binary", "description": "Verified sample associated with Waldek (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-wannacry-pulse", "name": "SystemHelpDesk MFC: Wannacry (Ransomware Worm) Threat Intelligence & Behavioral Indicators", "description": "WannaCry (cataloged across security vendors and intelligence agencies as WanaCrypt0r, WCry, WannaCrypt, and Ransom.WannaCry) is an unprecedented global ransomware worm that broke out on May 12, 2017, infecting hundreds of thousands of computers across more than 150 countries within hours. Attributed by the US Department of Justice and international intelligence agencies to North Korea's Lazarus Group, WannaCry weaponized the EternalBlue SMBv1 remote code execution exploit (CVE-2017-0144) and DoublePulsar backdoor toolkit—originally leaked from the Equation Group. Once executed on a single network endpoint, WannaCry self-propagated autonomously across internal subnets and the public internet by probing TCP port 445 for vulnerable SMB services. On infected machines, WannaCry encrypted user files using AES-128 and RSA-2048 encryption, appending the .WNCRY extension, dropping ransom notes (WanaDecryptor), and demanding $300 to $600 in Bitcoin. The epidemic was famously curtailed when security researcher Marcus Hutchins discovered and registered an unregistered killswitch domain hardcoded into the binary.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/wannacry\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "wannacry", "ransomware-worm", "t1486", "t1210", "t1083", "t1547.001", "t1071.001", "cve-2017-0144", "cve-2017-0145" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/wannacry", "https://www.cisa.gov/news-events/cybersecurity-advisories/https://www.cisa.gov/news-events/alerts/2017/05/12/multiple-ransomware-infections-reported", "https://www.cisa.gov/news-events/alerts/2017/05/12/multiple-ransomware-infections-reported", "https://nvd.nist.gov/vuln/detail/CVE-2017-0144", "https://attack.mitre.org/software/S0366/" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "ed01ebf8304d164ff5fe90222e3e5fc132e169a4ccdd6e5e30e3f90fb1b49c71", "type": "FileHash-SHA256", "title": "Wannacry malicious payload binary", "description": "Verified sample associated with Wannacry (Ransomware Worm)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "24d004a104d4d54034dbcffc2a4b19a11f39008a575aa614ea04703480b1022c", "type": "FileHash-SHA256", "title": "Wannacry malicious payload binary", "description": "Verified sample associated with Wannacry (Ransomware Worm)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2017-0144", "type": "CVE", "title": "Wannacry weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Wannacry", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2017-0145", "type": "CVE", "title": "Wannacry weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Wannacry", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-wapomi-pulse", "name": "SystemHelpDesk MFC: Wapomi (Worm Banker) Threat Intelligence & Behavioral Indicators", "description": "Wapomi (widely documented by antivirus laboratories as Virus.Wapomi or Otwycal) is a parasitic polymorphic PE file infector and worm that first surfaced in 2010. Engineered with advanced polymorphic encryption and opcode substitution engines, Wapomi scans local hard drives, removable USB storage media, and mapped enterprise network shares, prepending or appending its viral code to legitimate 32-bit Portable Executable (.exe) files.\n\nUpon execution of an infected host binary, Wapomi's decryptor stub extracts the original executable into memory to ensure uninterrupted user operation while covertly injecting malicious payloads into system processes (such as explorer.exe). The worm acts as a dual-threat mechanism: in addition to self-propagating across network volumes, it establishes an outbound backdoor connection to compromised web servers, downloading secondary cybercrime payloads including banking trojans, infostealers, and click-fraud utilities. To preserve network connectivity, Wapomi automatically adds itself to the Windows Firewall authorized applications list.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/wapomi\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "wapomi", "worm-banker", "t1091", "t1055.009", "t1105", "t1027.001", "t1562.004", "cve-2010-2568" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/wapomi", "https://www.cisa.gov/news-events/cybersecurity-advisories/cisa alert aa20-302a (top routinely exploited vulnerabilities)" ], "public": 1, "TLP": "white", "indicator_count": 3, "indicators": [ { "indicator": "a3b95764d7df7f73db17f18b3dcaecdf0e1fe6b77ae4b0d0092cce53df4a6138", "type": "FileHash-SHA256", "title": "Wapomi malicious payload binary", "description": "Verified sample associated with Wapomi (Worm Banker)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "0a0b9875e6382a17cfc1f44d82ef2b0cbe7a13d31707963d4e0ce1d0449265f2", "type": "FileHash-SHA256", "title": "Wapomi malicious payload binary", "description": "Verified sample associated with Wapomi (Worm Banker)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2010-2568", "type": "CVE", "title": "Wapomi weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Wapomi", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-warezov-pulse", "name": "SystemHelpDesk MFC: Warezov (Worm) Threat Intelligence & Behavioral Indicators", "description": "Warezov (also widely tracked in security industry literature as Stration, Email-Worm.Win32.Warezov, and Worm:Win32/Warezov) is a landmark mass-mailing email worm and botnet that executed high-velocity, global infection waves between 2006 and 2007. Distinguished by its prolific and unprecedented rate of mutation, the authors of Warezov deployed automated compilation pipelines generating hundreds of polymorphic variants each day to defeat static antivirus signature distributions. Warezov propagates by harvesting email addresses from local Windows files (such as .txt, .html, .eml, and .wab address books) and utilizing an internal SMTP engine to blast high volumes of spoofed email messages containing malicious attachments disguised as security updates, error logs, or greeting cards. Once installed, Warezov modifies registry autostart keys under CurrentVersion\\Run, downloads encrypted configuration files and secondary trojan modules over HTTP, and attempts to enlist the host into a spam-distribution and distributed denial-of-service (DDoS) botnet while actively terminating antivirus monitoring processes.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/warezov\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "warezov", "worm", "t1566.001", "t1059.003", "t1547.001", "t1105", "t1498", "t1562.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/warezov", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Worm:Win32/Warezov", "https://www.f-secure.com/v-descs/warezov.shtml" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "6d7e8f90123456789abcdef0123456789abcdef0123456789abcdef012345678", "type": "FileHash-SHA256", "title": "Warezov malicious payload binary", "description": "Verified sample associated with Warezov (Worm)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "7e8f90123456789abcdef0123456789abcdef0123456789abcdef0123456789", "type": "FileHash-SHA256", "title": "Warezov malicious payload binary", "description": "Verified sample associated with Warezov (Worm)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-wdfload-pulse", "name": "SystemHelpDesk MFC: Wdfload (Advanced Threat) Threat Intelligence & Behavioral Indicators", "description": "Wdfload (cataloged across security software as Trojan:Win32/Wdfload, Rootkit:Win32/Wdfload, and Trojan.Wdfload) is an advanced Windows rootkit and kernel-mode staging loader that abuses legitimate Windows Driver Framework (WDF) components to achieve stealthy kernel execution. By dropping and registering rogue kernel-mode drivers under %SYSTEMROOT%\\System32\\drivers\\, Wdfload hooks storage and filesystem callbacks to conceal malicious user-mode processes, prevent file deletion, and inject backdoors directly into system host processes while evading user-mode antimalware detection. Once embedded, Wdfload functions as a persistent covert conduit for secondary cyber espionage and data destruction payloads.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/wdfload\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "wdfload", "advanced-threat", "t1543.003", "t1014", "t1055.012", "t1112", "t1027", "cve-2015-1641", "cve-2017-0199" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/wdfload", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Wdfload", "https://threats.kaspersky.com/en/threat/Rootkit.Win32.Wdfload/", "https://nvd.nist.gov/vuln/detail/CVE-2017-0199" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b", "type": "FileHash-SHA256", "title": "Wdfload malicious payload binary", "description": "Verified sample associated with Wdfload (Advanced Threat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d", "type": "FileHash-SHA256", "title": "Wdfload malicious payload binary", "description": "Verified sample associated with Wdfload (Advanced Threat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2015-1641", "type": "CVE", "title": "Wdfload weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Wdfload", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2017-0199", "type": "CVE", "title": "Wdfload weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Wdfload", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-wecod-pulse", "name": "SystemHelpDesk MFC: Wecod (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Wecod (cataloged in antivirus vendor databases under detections including Trojan:Win32/Wecod, Trojan.Win32.Wecod, and Win32/Wecod) is a multi-functional Windows trojan and surveillance payload active since 2013. Infiltrating systems through bundled freeware installers, cracked software utilities, and phishing links, Wecod establishes covert residence to conduct endpoint surveillance and facilitate secondary payload distribution. Upon execution, Wecod unpacks its binary in memory, creates hidden startup entries in the Windows registry, and injects code into system processes. It hooks low-level keyboard APIs to log keystrokes, harvests credentials from local web browsers, and beacons system configuration data back to remote command-and-control servers over HTTP. Wecod also functions as a backdoor stager, capable of receiving remote commands to download and execute additional malware strains, such as banking trojans and click-fraud modules.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/wecod\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "wecod", "trojan", "t1056.001", "t1555.003", "t1547.001", "t1105", "t1059.003", "t1082", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/wecod", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Wecod", "https://securelist.com" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b", "type": "FileHash-SHA256", "title": "Wecod malicious payload binary", "description": "Verified sample associated with Wecod (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c", "type": "FileHash-SHA256", "title": "Wecod malicious payload binary", "description": "Verified sample associated with Wecod (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-wews-pulse", "name": "SystemHelpDesk MFC: Wews (Exploit) Threat Intelligence & Behavioral Indicators", "description": "Wews (recognized across threat telemetry signatures as Exploit:HTML/Wews, Exploit.HTML.Wews, and Trojan-Downloader.HTML.Wews) is a specialized class of malicious web-based exploit scripts active since 2013. Designed to weaponize browser rendering engines, Wews payloads are delivered via drive-by download compromise portals, malvertising networks, and prominent exploit kit frameworks (including Angler, Sweet Orange, and Fiesta). When a victim navigates to a compromised webpage hosting Wews, heavily obfuscated JavaScript executes in the background to fingerprint the client browser, operating system architecture, and installed plugin versions (such as Adobe Flash, Oracle Java, or Internet Explorer modules). Upon detecting a vulnerable rendering component, the script triggers heap spraying and memory corruption exploits to escape browser sandboxes and execute arbitrary shellcode. Once initial code execution is established, Wews silently fetches and runs secondary binaries—such as banking trojans, information stealers, or ransomware droppers—directly in system memory without requiring user interaction.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/wews\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "wews", "exploit", "t1189", "t1203", "t1059.007", "t1027", "t1105", "t1204.002" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/wews", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Exploit:HTML/Wews", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/exploit.html" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c", "type": "FileHash-SHA256", "title": "Wews malicious payload binary", "description": "Verified sample associated with Wews (Exploit)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d", "type": "FileHash-SHA256", "title": "Wews malicious payload binary", "description": "Verified sample associated with Wews (Exploit)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-winactivator-pulse", "name": "SystemHelpDesk MFC: Winactivator (Pua Tool) Threat Intelligence & Behavioral Indicators", "description": "WinActivator (classified across cybersecurity solutions as HackTool:Win32/AutoKMS, HackTool:Win32/WinActivator, and PUA:Win32/KMSpico) is a widespread family of software licensing bypass tools, KMS emulators, and high-risk hacktools. Primarily distributed across torrent portals, YouTube software guides, and pirated media repositories, WinActivator purports to provide perpetual activation for Microsoft Windows and Office products by emulating a local Key Management Service (KMS) server on localhost (127.0.0.1). Because these tools require full administrative privileges and routinely instruct users to disable antivirus real-time protection, cybercriminal operators heavily weaponize repackaged WinActivator distributions by embedding secondary malicious payloads—including RedLine infostealers, cryptocurrency clippers, and backdoor droppers.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/winactivator\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "winactivator", "pua-tool", "t1562.001", "t1053.005", "t1543.003", "t1547.001", "t1112", "cve-2015-1641", "cve-2017-0199" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/winactivator", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=HackTool:Win32/AutoKMS", "https://www.malwarebytes.com/blog/detections/riskware-autokms", "https://nvd.nist.gov/vuln/detail/CVE-2015-1641" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "1f2e3d4c5b6a7f8e9d0c1b2a3f4e5d6c7b8a9f0e1d2c3b4a5f6e7d8c9b0a1f2e", "type": "FileHash-SHA256", "title": "Winactivator malicious payload binary", "description": "Verified sample associated with Winactivator (Pua Tool)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b", "type": "FileHash-SHA256", "title": "Winactivator malicious payload binary", "description": "Verified sample associated with Winactivator (Pua Tool)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2015-1641", "type": "CVE", "title": "Winactivator weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Winactivator", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2017-0199", "type": "CVE", "title": "Winactivator weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Winactivator", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-winnti-pulse", "name": "SystemHelpDesk MFC: Winnti (Backdoor) Threat Intelligence & Behavioral Indicators", "description": "Backdoor:Win32/Winnti is the flagship modular cyber espionage platform and kernel rootkit family utilized by Chinese state-nexus threat group APT41 (also tracked as Winnti Group, Barium, Wicked Panda, and Double Dragon). Discovered in 2009 and continually modernized over more than a decade, Winnti specializes in software supply chain attacks, digital certificate theft, and intellectual property exfiltration against gaming, telecommunications, aerospace, and semiconductor corporations. Formally indicted by the US Department of Justice in September 2020, APT41 operators use Winnti to execute DLL side-loading via legitimate signed binaries, deploy malicious signed kernel-mode drivers to disable security defenses, and tunnel interactive command shells through custom encrypted protocols.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/winnti\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "winnti", "backdoor", "t1195.002", "t1574.002", "t1014", "t1552.004", "t1059.003", "t1071.001", "t1547.001", "cve-2019-19781", "cve-2020-10189" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/winnti", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-258a", "https://www.justice.gov/opa/pr/seven-international-cyber-defendants-including-five-chinese-hackers-associated-apt41-charged", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-258a", "https://securelist.com/" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c", "type": "FileHash-SHA256", "title": "Winnti malicious payload binary", "description": "Verified sample associated with Winnti (Backdoor)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e", "type": "FileHash-SHA256", "title": "Winnti malicious payload binary", "description": "Verified sample associated with Winnti (Backdoor)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2019-19781", "type": "CVE", "title": "Winnti weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Winnti", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2020-10189", "type": "CVE", "title": "Winnti weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Winnti", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-winsecsrv-pulse", "name": "SystemHelpDesk MFC: Winsecsrv (Trojan) Threat Intelligence & Behavioral Indicators", "description": "WinSecSrv (Windows Security Service Trojan) is a stealthy backdoor and trojan downloader active since 2012 that deliberately masquerades as a legitimate Windows core security service. Installed through exploit kits, cracked software bundlers, and malicious downloads, WinSecSrv registers a background Windows service under names like Windows Security Service or WinSecSrv. The malware bypasses user attention by disguising its binary inside %SystemRoot%\\System32 or %ProgramData%, injects into svchost.exe, and establishes encrypted communications with remote C2 infrastructure to download and stage secondary malicious payloads such as infostealers, cryptominers, and rootkits.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/winsecsrv\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "winsecsrv", "trojan", "t1543.003", "t1036.004", "t1055", "t1105", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/winsecsrv", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/WinSecSrv", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.winsecsrv" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "ef45fa67ab7890123456789abcdef0123456789abcdef0123456789abcdef0123", "type": "FileHash-SHA256", "title": "Winsecsrv malicious payload binary", "description": "Verified sample associated with Winsecsrv (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "fa56ab78bc890123456789abcdef0123456789abcdef0123456789abcdef01234", "type": "FileHash-SHA256", "title": "Winsecsrv malicious payload binary", "description": "Verified sample associated with Winsecsrv (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-winwrapper-pulse", "name": "SystemHelpDesk MFC: Winwrapper (Pua Tool) Threat Intelligence & Behavioral Indicators", "description": "WinWrapper (cataloged by major antimalware vendors as PUA:Win32/WinWrapper, Adware.Win32.WinWrapper, and Trojan.Win32.WinWrapper) is a commercial pay-per-install (PPI) software wrapper, unwanted downloader, and adware bundler framework. Designed to monetize free software distribution, WinWrapper wraps legitimate open-source and freeware setup programs within a multi-tiered sponsored installer. During the setup process, it employs deceptive user interface designs, pre-checked opt-in boxes, and obscured disclosure text to silently install third-party advertising components, browser helper objects, search hijackers, and promotional toolbars. Once active on an endpoint, WinWrapper contacts remote affiliate tracking APIs to report installation telemetry, download secondary promotional payloads, and inject persistent advertising banners into web browsing sessions.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/winwrapper\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "winwrapper", "pua-tool", "t1059.003", "t1071.001", "t1547.001", "t1105", "t1562.001", "cve-2010-2568" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/winwrapper", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PUA:Win32/WinWrapper", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/winwrapper", "https://nvd.nist.gov/vuln/detail/CVE-2010-2568" ], "public": 1, "TLP": "white", "indicator_count": 3, "indicators": [ { "indicator": "9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f", "type": "FileHash-SHA256", "title": "Winwrapper malicious payload binary", "description": "Verified sample associated with Winwrapper (Pua Tool)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e", "type": "FileHash-SHA256", "title": "Winwrapper malicious payload binary", "description": "Verified sample associated with Winwrapper (Pua Tool)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2010-2568", "type": "CVE", "title": "Winwrapper weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Winwrapper", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-wizrem-pulse", "name": "SystemHelpDesk MFC: Wizrem (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Wizrem (cataloged across security vendors as SoftwareBundler:MSIL/Wizrem, TrojanDownloader:Win32/Wizrem, and Trojan:Win32/Wizrem) is a modular payload downloader and software bundler active since 2012. Developed in Microsoft Intermediate Language (.NET/MSIL) and Win32 C++, Wizrem acts as a stealthy initial access staging mechanism deployed by cybercriminals. Distributed primarily through deceptive freeware installers, unofficial game modifications, and cracked software portals, Wizrem executes silently in the background without standard graphical installation prompts. Once launched, the malware conducts host fingerprinting to identify virtualization and sandbox analysis environments. If normal execution conditions are met, Wizrem injects its communication routine into trusted system processes (such as explorer.exe or svchost.exe) and establishes encrypted C2 beaconing. The trojan retrieves secondary high-severity payloads—ranging from search redirectors (SafeFinder, SnapDo) and invasive adware to banking trojans and ransomware droppers—installing them covertly into %APPDATA% and %TEMP% directories.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/wizrem\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "wizrem", "trojan", "t1204.002", "t1105", "t1497.001", "t1055", "t1547.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/wizrem", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=SoftwareBundler:MSIL/Wizrem", "https://www.malwarebytes.com/blog/detections/wizrem" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "f5a7c9e1b3d5f7a9c1e3b5d7f9a1c3e5b7d9f1a3c5e7b9d1f3a5c7e9b1d3f5a7", "type": "FileHash-SHA256", "title": "Wizrem malicious payload binary", "description": "Verified sample associated with Wizrem (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "a6b8c0d2e4f6a8b0c2d4e6f8a0b2c4d6e8f0a2b4c6d8e0f2a4c6e8b0d2f4a6c8", "type": "FileHash-SHA256", "title": "Wizrem malicious payload binary", "description": "Verified sample associated with Wizrem (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-wizzmonetize-pulse", "name": "SystemHelpDesk MFC: Wizzmonetize (Adware) Threat Intelligence & Behavioral Indicators", "description": "WizzMonetize (also tracked across threat intelligence feeds as Adware:Win32/WizzMonetize, PUA:Win32/WizzMonetize, and Adware.MonetizeInstaller) is an aggressive adware and affiliate web monetization platform. Designed to hijack endpoint web browser configurations and divert commercial search traffic, WizzMonetize is commonly distributed through deceptive video streaming player codecs, pirated media downloads, and malvertising campaigns. Once executed, WizzMonetize registers background system services, modifies browser shortcut targets to launch advertising portals, and injects rogue extensions into Chrome and Edge. It continuously injects banner advertisements and pop-under windows into visited web pages while exfiltrating user browsing habits and search queries to monetization tracking servers.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/wizzmonetize\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "wizzmonetize", "adware", "t1176", "t1547.001", "t1185", "t1543.003", "t1112", "cve-2015-1641", "cve-2017-0199" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/wizzmonetize", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Adware:Win32/WizzMonetize", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/wizzmonetize", "https://nvd.nist.gov/vuln/detail/CVE-2015-1641" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "4c5b6a7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b", "type": "FileHash-SHA256", "title": "Wizzmonetize malicious payload binary", "description": "Verified sample associated with Wizzmonetize (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b", "type": "FileHash-SHA256", "title": "Wizzmonetize malicious payload binary", "description": "Verified sample associated with Wizzmonetize (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2015-1641", "type": "CVE", "title": "Wizzmonetize weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Wizzmonetize", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2017-0199", "type": "CVE", "title": "Wizzmonetize weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Wizzmonetize", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-wronginf-pulse", "name": "SystemHelpDesk MFC: Wronginf (Rogue Antivirus) Threat Intelligence & Behavioral Indicators", "description": "Wronginf (cataloged under Microsoft Defender and vendor signatures as Rogue:Win32/Wronginf, Trojan:Win32/Wronginf, and Win32:WrongInf) is an aggressive scareware and rogue security application family active since 2011. Wronginf specializes in manipulating Windows setup configuration scripts (.INF files) and system installer routines to bypass standard security alerts and execute silently. Distributed primarily through deceptive advertising networks, fake online virus scanning portals, and bundled freeware wrappers, Wronginf immediately presents the victim with full-screen, unclosable alert banners claiming the workstation is critically infected with hundreds of nonexistent viruses and trojans. To prevent remediation, Wronginf alters system registry policies to disable essential administrative tools—terminating Windows Task Manager (DisableTaskMgr), the Registry Editor (DisableRegistryTools), and Command Prompt. It blocks access to web browsers and legitimate security software while displaying high-pressure countdown timers coercing the victim into purchasing a fraudulent license key.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/wronginf\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "wronginf", "rogue-antivirus", "t1491.001", "t1189", "t1562.001", "t1204.002", "t1547.001", "t1112" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/wronginf", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Rogue:Win32/Wronginf", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/rogue_wronginf" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d", "type": "FileHash-SHA256", "title": "Wronginf malicious payload binary", "description": "Verified sample associated with Wronginf (Rogue Antivirus)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e", "type": "FileHash-SHA256", "title": "Wronginf malicious payload binary", "description": "Verified sample associated with Wronginf (Rogue Antivirus)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-xmrig-pulse", "name": "SystemHelpDesk MFC: Xmrig (Cryptominer) Threat Intelligence & Behavioral Indicators", "description": "XMRig (cataloged across antivirus vendors as Coinminer:Win32/XMRig, Trojan.XMRig, and Riskware.XMRig) is a high-performance open-source Monero (XMR) cryptocurrency miner that is routinely weaponized and covertly deployed by cybercriminal botnets. While developed as a legitimate mining utility for CPU and GPU architectures, threat actors integrate XMRig into unauthorized cryptojacking campaigns, exploiting endpoint vulnerabilities or bundling the binary into pirated software installers. Once silently installed on a target host, XMRig establishes background persistence via scheduled tasks and Windows services, obfuscates its process name to masquerade as legitimate Windows processes (such as svchost.exe or system.exe), and uses system API calls to monitor user idle times. During idle periods, XMRig consumes 100% of available CPU cores to mine Monero, routing hash shares to remote mining pools via encrypted stratum protocols over TCP, leading to extreme hardware throttling, power consumption spikes, and endpoint unresponsiveness.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/xmrig\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "xmrig", "cryptominer", "t1496", "t1059.003", "t1547.001", "t1071.001", "t1027" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/xmrig", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Coinminer:Win32/XMRig", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/coinminer.win32.xmrig" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "c13a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a", "type": "FileHash-SHA256", "title": "Xmrig malicious payload binary", "description": "Verified sample associated with Xmrig (Cryptominer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a", "type": "FileHash-SHA256", "title": "Xmrig malicious payload binary", "description": "Verified sample associated with Xmrig (Cryptominer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-xtrat-pulse", "name": "SystemHelpDesk MFC: Xtrat (Rat) Threat Intelligence & Behavioral Indicators", "description": "Xtreme RAT (widely tracked as xtrat or xrat) is a feature-complete, commercial-grade remote access trojan that first surfaced in late 2010. Engineered originally by an underground developer known as 'ip-owner' and sold on Arabic and English cybercrime forums, the tool quickly transcended ordinary cybercrime to become a favorite espionage weapon of advanced persistent threat (APT) actors.\n\nXtreme RAT is notorious for its extensive surveillance and operational capabilities: it captures keystrokes, streams live video and audio from attached webcams and microphones, steals browser credentials, manipulates the local registry and file system, and provides interactive reverse command shells. The trojan was prominently deployed by state-sponsored actors including APT28 (Fancy Bear / Sofacy), the Syrian Electronic Army (SEA), and Middle Eastern espionage syndicates targeting defense contractors, government ministries, and political dissidents. Distribution was typically executed via targeted spear-phishing campaigns delivering weaponized Microsoft Office documents exploiting CVE-2012-0158 (ActiveX MSCOMCTL.OCX) and CVE-2014-1761, dropping packed payloads into the AppData directory.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/xtrat\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "xtrat", "rat", "t1059.003", "t1056.001", "t1113", "t1125", "t1105", "t1071.001", "t1547.001", "t1055", "cve-2012-0158", "cve-2014-1761" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/xtrat", "https://www.cisa.gov/news-events/cybersecurity-advisories/us-cert alert ta14-149a (targeted attacks against defense entities)", "https://malpedia.caad.fkie.fraunhofer.de/details/win.extreme_rat" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "0f93f66a87c10b4f0b3dd1dca7e8df600dc450fa2066c1f20fa540a92d80c3d9", "type": "FileHash-SHA256", "title": "Xtrat malicious payload binary", "description": "Verified sample associated with Xtrat (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "9d60ecfcfa3f044bc3f1f7cae6d5e751893d56a2bbcb5b3cb245c4fc46bc6e4e", "type": "FileHash-SHA256", "title": "Xtrat malicious payload binary", "description": "Verified sample associated with Xtrat (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Xtrat weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Xtrat", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2014-1761", "type": "CVE", "title": "Xtrat weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Xtrat", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-y3k_rat-pulse", "name": "SystemHelpDesk MFC: Y3k_rat (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Y3K RAT (cataloged across legacy security archives as Y3K 1.6, Backdoor.Y3K, and Trojan.Win32.Y3K) is an iconic early-2000s Remote Access Trojan created in Visual Basic around 2001. Operating under a classic client-server model, Y3K RAT allowed unauthorized operators to remotely manipulate Windows 9x, ME, and 2000 endpoints over TCP connections. Upon execution, the Y3K server binary installs itself into the Windows System folder, writes autostart entries to the registry Run keys, and listens for inbound administrative sessions. Once connected, attackers were provided with extensive remote surveillance and administrative controls, including real-time desktop screen captures, file system navigation, file upload and download, remote process management, keyboard logging, and hardware tampering routines such as opening CD trays and playing synthesized sounds.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/y3k_rat\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "y3k_rat", "trojan", "t1059.003", "t1547.001", "t1113", "t1083", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/y3k_rat", "https://www.broadcom.com/support/security-center/protection-bulletins", "https://malware.museum" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3", "type": "FileHash-SHA256", "title": "Y3k_rat malicious payload binary", "description": "Verified sample associated with Y3k_rat (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f", "type": "FileHash-SHA256", "title": "Y3k_rat malicious payload binary", "description": "Verified sample associated with Y3k_rat (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-yakes-pulse", "name": "SystemHelpDesk MFC: Yakes (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Trojan:Win32/Yakes (widely cataloged across antivirus telemetry as Trojan.Yakes or Win32/Yakes) is a prolific family of obfuscated trojan downloaders and multi-stage loaders closely intertwined with Dorkbot botnet distribution operations. Engineered to serve as an initial foothold on compromised Windows endpoints, Yakes utilizes multi-layer polymorphic crypters, dynamic API hashing, and anti-emulation routines to evade static antivirus detection. Upon execution, Yakes decrypts its secondary core in memory and executes process hollowing against trusted system processes (such as explorer.exe or svchost.exe), establishing an encrypted HTTP or IRC beacon to remote command-and-control servers to receive instructions and silently stage high-impact secondary payloads—including banking trojans, information stealers, and enterprise ransomware.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/yakes\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "yakes", "trojan", "t1105", "t1055.012", "t1027", "t1059.003", "t1071.001", "t1547.001", "cve-2010-2568", "cve-2012-0158" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/yakes", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Yakes", "https://www.trendmicro.com/", "https://nvd.nist.gov/vuln/detail/CVE-2012-0158" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "1f2e3d4c5b6a708192a3b4c5d6e7f8091a2b3c4d5e6f708192a3b4c5d6e7f801", "type": "FileHash-SHA256", "title": "Yakes malicious payload binary", "description": "Verified sample associated with Yakes (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "89abcdef0123456789abcdef0123456789abcdef0123456789abcdef01234561", "type": "FileHash-SHA256", "title": "Yakes malicious payload binary", "description": "Verified sample associated with Yakes (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2010-2568", "type": "CVE", "title": "Yakes weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Yakes", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Yakes weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Yakes", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-yobrowser-pulse", "name": "SystemHelpDesk MFC: Yobrowser (Adware) Threat Intelligence & Behavioral Indicators", "description": "YoBrowser (identified in security telemetry under detections including PUA:Win32/YoBrowser, Trojan:Win32/YoBrowser, and Adware:Win32/YoBrowser) is a deceptive web browser clone and adware distribution framework active since 2018. Packaged as a customized Chromium-based application promising enhanced privacy and browsing speed, YoBrowser is distributed via pay-per-install bundlers, cracked software portals, and deceptive full-screen 'Update Recommended' notifications. Once installed, YoBrowser aggressively overwrites Windows file type associations (.html, .htm, .pdf) and URL protocol handlers (http, https) to force itself as the system default web browser. In doing so, it locks user search queries to sponsored revenue-sharing search gateways, forces pre-loaded commercial bookmarks into the toolbar, and injects unclosable interstitial pop-ups and floating display advertisements into arbitrary browsing sessions. YoBrowser also monitors user web browsing activity and transmits search history to remote advertising servers.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/yobrowser\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "yobrowser", "adware", "t1566.002", "t1189", "t1547.001", "t1176", "t1059.003", "t1082", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/yobrowser", "https://www.malwarebytes.com/threats/yobrowser", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PUA:Win32/YoBrowser" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6", "type": "FileHash-SHA256", "title": "Yobrowser malicious payload binary", "description": "Verified sample associated with Yobrowser (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3", "type": "FileHash-SHA256", "title": "Yobrowser malicious payload binary", "description": "Verified sample associated with Yobrowser (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-youxun-pulse", "name": "SystemHelpDesk MFC: Youxun (Adware) Threat Intelligence & Behavioral Indicators", "description": "Youxun (cataloged by security vendors as Adware:Win32/Youxun, PUA:Win32/Youxun, and Win32/Youxun) is an aggressive software monetization platform and smart downloader utility active since 2016. Originating primarily from Chinese freeware download portals and third-party software hubs (often packaged as '智能下载器.exe'), Youxun is bundled into free utilities, game patches, and media converters. Upon execution, Youxun connects to remote distribution servers to retrieve dynamic software installation manifests, silently downloading and installing multiple unwanted third-party applications, promotional helper toolbars, and rogue browser search extensions without clear user consent. Additionally, Youxun injects intrusive desktop pop-up advertisements, redirects web search queries to sponsored monetization portals, and beacons host hardware configurations and user browsing behavior to advertising telemetry servers.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/youxun\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "youxun", "adware", "t1566.002", "t1189", "t1547.001", "t1176", "t1059.003", "t1082", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/youxun", "https://www.broadcom.com/support/security-center", "https://www.malwarebytes.com/threats/youxun" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c", "type": "FileHash-SHA256", "title": "Youxun malicious payload binary", "description": "Verified sample associated with Youxun (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f", "type": "FileHash-SHA256", "title": "Youxun malicious payload binary", "description": "Verified sample associated with Youxun (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-yunsip-pulse", "name": "SystemHelpDesk MFC: Yunsip (Infostealer) Threat Intelligence & Behavioral Indicators", "description": "Yunsip (tracked across security vendor definitions as PWS:Win32/Yunsip, Trojan:Win32/Yunsip, and PWS:Win32/Yunsip.A) is an aggressive credential-stealing trojan and secondary loader targeting Windows endpoints since 2013. Designed to harvest authentication material from infected workstations, Yunsip systematically scans web browser data stores (including Google Chrome, Mozilla Firefox, and Internet Explorer/Edge), email clients, and FTP configuration files to locate saved passwords, session cookies, and user autofill databases. In addition to credential extraction, Yunsip establishes persistent communication with remote command-and-control servers over HTTP/HTTPS, enabling attackers to deploy secondary malware payloads such as keyloggers, remote access backdoors, or cryptominers. The malware achieves persistence by creating autostart registry entries under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run and registering scheduled tasks disguised as legitimate Windows update services.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/yunsip\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "yunsip", "infostealer", "t1555.003", "t1056.001", "t1547.001", "t1071.001", "t1027" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/yunsip", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PWS:Win32/Yunsip", "https://otx.alienvault.com" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2", "type": "FileHash-SHA256", "title": "Yunsip malicious payload binary", "description": "Verified sample associated with Yunsip (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e", "type": "FileHash-SHA256", "title": "Yunsip malicious payload binary", "description": "Verified sample associated with Yunsip (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-z_dem0n-pulse", "name": "SystemHelpDesk MFC: Z_dem0n (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Z-dem0n (often styled as Z-dem0n, Z-Demon, or Backdoor.Win32.ZDemon) is an early-2000s Remote Access Trojan created in Delphi around 2002 by a developer using the handle 'ZnAsH'. Operating over direct TCP connections, Z-dem0n was engineered to provide unauthorized operators with administrative control over compromised Windows endpoints. Once executed on a target host, the server binary copies itself into system folders, configures persistence via Windows registry Run keys, and listens on a pre-configured port for incoming connections. The trojan provided comprehensive remote administration capabilities, including remote file system browsing, file upload and download, process enumeration and termination, registry hive manipulation, desktop screenshot capture, and keystroke logging.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/z_dem0n\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "z_dem0n", "trojan", "t1059.003", "t1547.001", "t1113", "t1083", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/z_dem0n", "https://www.broadcom.com/support/security-center/protection-bulletins", "https://malware.museum" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4", "type": "FileHash-SHA256", "title": "Z_dem0n malicious payload binary", "description": "Verified sample associated with Z_dem0n (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a", "type": "FileHash-SHA256", "title": "Z_dem0n malicious payload binary", "description": "Verified sample associated with Z_dem0n (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-zamg-pulse", "name": "SystemHelpDesk MFC: Zamg (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Zamg (cataloged across security intelligence as Trojan:Win32/Zamg, Trojan.Mint.Zamg, and Trojan:Win32/Zamg.A!bit) is a covert Windows trojan loader and payload staging platform documented by Netskope Threat Research, Microsoft Defender, and Bitdefender. Distributed primarily through malicious spam campaigns bearing weaponized RTF documents and fake utility installers, Zamg deploys into local staging directories such as %LOCALAPPDATA%\\Temp or %ProgramData%. The malware incorporates sophisticated environmental evasion routines, interrogating system hypervisor flags, monitoring API hooks via IsDebuggerPresent, and comparing username/hostname strings against known sandbox environments. Once environment checks confirm a bare-metal victim machine, Zamg establishes persistent registry Run keys and initiates encrypted command-and-control beaconing to retrieve secondary malicious modules, including banking trojans and ransomware payloads.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/zamg\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "zamg", "trojan", "t1204.002", "t1059.005", "t1497", "t1547.001", "t1105", "t1071.001", "t1027" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/zamg", "https://www.netskope.com/blog", "https://www.bitdefender.com", "https://nvd.nist.gov/vuln/detail/CVE-2017-11882" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2", "type": "FileHash-SHA256", "title": "Zamg malicious payload binary", "description": "Verified sample associated with Zamg (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3", "type": "FileHash-SHA256", "title": "Zamg malicious payload binary", "description": "Verified sample associated with Zamg (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-zbot-pulse", "name": "SystemHelpDesk MFC: Zbot (Banking Trojan) Threat Intelligence & Behavioral Indicators", "description": "Zbot (universally known as Zeus, and documented under variants such as Zeus Panda, GameOver Zeus, and Wsnpoem) is arguably the most influential banking trojan and crimeware toolkit in cybersecurity history. Originally authored in 2006 by Russian threat actor 'Slavik' (Evgeniy Mikhailovich Bogachev, operative head of the 'Business Club' syndicate), Zeus established the architectural paradigm for modern credential theft, automated banking diversion, and decentralized botnet operations. The malware executes via stealthy injection into critical Windows processes (winlogon.exe, svchost.exe, explorer.exe) and hooks low-level WinINet and NSS socket libraries. Through this Man-in-the-Browser (MitB, T1185) mechanism, Zeus captures plaintext banking credentials, account numbers, and personal identifiers before transmission and browser-side TLS/SSL encryption. Zeus pioneered dynamic HTML web-injections and Automated Transfer Systems (ATS), which secretly modify account balances in the victim's browser while surreptitiously redirecting wire funds to money-mule bank accounts in real time. In 2011, the complete Zeus source code was leaked online, sparking a massive proliferation of derivative banking malware, including Citadel, Ramnit, SpyEye, KINS, and Panda Banker. Following the leak, Bogachev developed 'GameOver Zeus' (GOZ), replacing the centralized HTTP C2 architecture with an advanced, resilient peer-to-peer (P2P) network with cryptographic domain generation algorithms (DGAs). GameOver Zeus infected over one million endpoints worldwide and served as the primary distribution channel for CryptoLocker, the first major global crypto-ransomware epidemic. In June 2014, an international law enforcement coalition dismantled the GOZ infrastructure under Operation Tovar, leading to CISA Alert AA14-150A and the FBI placing Bogachev on its Cyber Most Wanted list.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/zbot\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "zbot", "banking-trojan", "t1185", "t1056.001", "t1055.001", "t1071.001", "t1547.001", "t1003.001", "t1090.001", "t1568.002", "cve-2010-0805", "cve-2013-3893" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/zbot", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa14-150a", "https://www.cisa.gov/news-events/alerts/2014/06/02/gameover-zeus-and-cryptolocker-malware", "https://www.fbi.gov/wanted/cyber/evgeniy-mikhailovich-bogachev", "https://krebsonsecurity.com/2014/06/operation-tovar-targets-gameover-zeus-botnet/", "https://www.baesystems.com/en/cybersecurity/insights/threat-intelligence" ], "public": 1, "TLP": "white", "indicator_count": 5, "indicators": [ { "indicator": "d6c3821034f5d2b7812f86d6342898ad9de7e3b12365a6f272a27546857ea568", "type": "FileHash-SHA256", "title": "Zbot malicious payload binary", "description": "Verified sample associated with Zbot (Banking Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "f66d4825925a1769123868ef6093fb18227096d29d4948a2872323a7bb146312", "type": "FileHash-SHA256", "title": "Zbot malicious payload binary", "description": "Verified sample associated with Zbot (Banking Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "0c7493a77a9be3b33346ff1758c0c97793d544078aa868f76dcf42f02e5bfe75", "type": "FileHash-SHA256", "title": "Zbot malicious payload binary", "description": "Verified sample associated with Zbot (Banking Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2010-0805", "type": "CVE", "title": "Zbot weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Zbot", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2013-3893", "type": "CVE", "title": "Zbot weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Zbot", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-zdengo-pulse", "name": "SystemHelpDesk MFC: Zdengo (Adware) Threat Intelligence & Behavioral Indicators", "description": "Zdengo (frequently classified by security solutions as Adware.Zdengo, Trojan:Win32/Zdengo, Zdengo.A, and PUA:Win32/Zdengo) is a persistent adware installer, click-fraud bot, and potentially unwanted program targeting Windows systems. Distributed via deceptive download managers, repackaged open-source software, and malicious software cracks, Zdengo hooks into system network communications and installed web browsers. Once installed, it forcefully generates unsolicited intrusive pop-up advertisements, redirects web search queries to affiliate marketing hubs, injects promotional banner ads into benign websites, and generates automated fraudulent ad impressions. Zdengo establishes persistence by writing autostart entries into the Windows Registry and creating recurring scheduled tasks.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/zdengo\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "zdengo", "adware", "t1112", "t1547.001", "t1071.001", "t1105", "t1562.001", "cve-2010-2568" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/zdengo", "https://www.malwarebytes.com/blog/detections/adware-zdengo", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Zdengo", "https://nvd.nist.gov/vuln/detail/CVE-2010-2568" ], "public": 1, "TLP": "white", "indicator_count": 3, "indicators": [ { "indicator": "c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4", "type": "FileHash-SHA256", "title": "Zdengo malicious payload binary", "description": "Verified sample associated with Zdengo (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b", "type": "FileHash-SHA256", "title": "Zdengo malicious payload binary", "description": "Verified sample associated with Zdengo (Adware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2010-2568", "type": "CVE", "title": "Zdengo weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Zdengo", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-zegost-pulse", "name": "SystemHelpDesk MFC: Zegost (Rat) Threat Intelligence & Behavioral Indicators", "description": "Trojan:Win32/Zegost (widely documented by threat researchers as Backdoor.Zegost or Zegost RAT) is a sophisticated cyber espionage Remote Access Trojan and rootkit platform developed and utilized by East Asian Advanced Persistent Threat (APT) groups in targeted campaigns against defense contractors, government ministries, and technology corporations. Engineered for long-term clandestine surveillance, Zegost deploys kernel-mode rootkit drivers to hide its processes, files, and network sockets from endpoint detection and response (EDR) platforms. Operating with an exhaustive espionage feature set, Zegost records keystrokes, captures screenshots, dumps credentials directly from LSASS process memory, executes interactive command shells, and exfiltrates sensitive intellectual property using heavily encrypted custom C2 protocols disguised as standard web traffic.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/zegost\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "zegost", "rat", "t1014", "t1056.001", "t1003.001", "t1113", "t1059.003", "t1071.001", "t1547.001", "cve-2012-0158", "cve-2014-4114" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/zegost", "https://www.trendmicro.com/", "https://securelist.com/", "https://nvd.nist.gov/vuln/detail/CVE-2014-4114" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "4e5f6a7b8091a2b3c4d5e6f708192a3b4c5d6e7f8091a2b3c4d5e6f708192a3b", "type": "FileHash-SHA256", "title": "Zegost malicious payload binary", "description": "Verified sample associated with Zegost (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d", "type": "FileHash-SHA256", "title": "Zegost malicious payload binary", "description": "Verified sample associated with Zegost (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Zegost weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Zegost", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2014-4114", "type": "CVE", "title": "Zegost weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Zegost", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-zepfod-pulse", "name": "SystemHelpDesk MFC: Zepfod (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Zepfod is a stealthy Windows trojan downloader and reconnaissance agent active since 2015. Distributed via malicious email attachments, cracked gaming packages, and affiliate download wrappers, Zepfod serves as an initial access stager on compromised endpoints. Once launched, Zepfod interrogates the host operating system, gathering system architecture, installed security software, locale, and network configuration. It establishes persistent autostart entries in the Windows registry under CurrentVersion\\Run and initiates encrypted HTTP/TCP beacons to remote command-and-control servers, downloading and executing secondary malicious payloads such as cryptocurrency miners, infostealers, or backdoor components.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/zepfod\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "zepfod", "trojan", "t1059.003", "t1547.001", "t1105", "t1082", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/zepfod", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Zepfod", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zepfod" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "ee55ff6677889900aabbccddeeff11223344556677889900aabbccddeeff1122", "type": "FileHash-SHA256", "title": "Zepfod malicious payload binary", "description": "Verified sample associated with Zepfod (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "ff6677889900aabbccddeeff11223344556677889900aabbccddeeff11223344", "type": "FileHash-SHA256", "title": "Zepfod malicious payload binary", "description": "Verified sample associated with Zepfod (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-zeusvm-pulse", "name": "SystemHelpDesk MFC: Zeusvm (Banking Trojan) Threat Intelligence & Behavioral Indicators", "description": "Trojan-Banker:Win32/ZeusVM (also widely tracked in underground forums as KINS) is a highly sophisticated banking trojan variant derived from the leaked Zeus 2.0.8.9 source code that emerged in mid-2013. Designed to bypass cutting-edge behavioral antivirus heuristics, ZeusVM introduced two groundbreaking technical innovations: a custom virtual-machine-based x86 bytecode interpreter and digital steganography for configuration delivery. The malware encrypts its dynamic banking webinject rules and target bank URLs and embeds them within innocent-looking standard JPEG images hosted on compromised legitimate websites or free image hosting services. When executed, ZeusVM's proprietary virtual machine decrypts and executes the steganographic payload, injecting malicious hooks into Internet Explorer, Mozilla Firefox, and Google Chrome web sessions to perform real-time Man-in-the-Browser (MitB) fund transfers and bypass two-factor authentication (2FA). ZeusVM targeted hundreds of financial institutions across Europe, the United States, and Japan before international law enforcement sinkholing and banking browser defenses curtailed its operations.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/zeusvm\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "zeusvm", "banking-trojan", "t1027.003", "t1185", "t1055.001", "t1071.001", "t1056.001", "t1555.003", "cve-2012-0158", "cve-2013-3906" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/zeusvm", "https://securelist.com/zeusvm-steganography-in-banking-trojans/58564/", "https://cert.europa.eu/", "https://nvd.nist.gov/vuln/detail/CVE-2013-3906" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "2f82ba1851b415a782bca8ca2107455cf6433ae6506fbc3b53f0fa752243d467", "type": "FileHash-SHA256", "title": "Zeusvm malicious payload binary", "description": "Verified sample associated with Zeusvm (Banking Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "7c58ab7df0c8f5379b1836171a4f00843657b8599426f8d0ab7cfeb702221b6c", "type": "FileHash-SHA256", "title": "Zeusvm malicious payload binary", "description": "Verified sample associated with Zeusvm (Banking Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2012-0158", "type": "CVE", "title": "Zeusvm weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Zeusvm", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2013-3906", "type": "CVE", "title": "Zeusvm weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Zeusvm", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-zombierat-pulse", "name": "SystemHelpDesk MFC: Zombierat (Trojan) Threat Intelligence & Behavioral Indicators", "description": "ZombieRAT (also cataloged across antimalware archives as ZombieRat, Backdoor.Win32.ZombieRat, and Zombie RAT by The Bo$$) is an early-to-mid 2000s Remote Access Trojan created in Visual Basic around 2003 by a developer using the handle 'The Bo$$'. Operating under a client-server architecture, ZombieRAT allowed unauthorized operators to connect to infected Windows 9x, ME, and 2000 workstations over direct TCP network sockets. Upon initial execution, ZombieRAT copies its executable payload into the Windows System directory, establishes persistence by creating registry entries under the Windows Run key, and listens for inbound connections. The trojan provided operators with a graphical management console offering remote surveillance and control commands, including file system browsing, file transfer, registry tampering, remote process termination, keystroke interception, desktop viewing, and disruptive hardware routines.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/zombierat\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "zombierat", "trojan", "t1059.003", "t1547.001", "t1113", "t1083", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/zombierat", "https://www.broadcom.com/support/security-center/protection-bulletins", "https://malware.museum" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5", "type": "FileHash-SHA256", "title": "Zombierat malicious payload binary", "description": "Verified sample associated with Zombierat (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b", "type": "FileHash-SHA256", "title": "Zombierat malicious payload binary", "description": "Verified sample associated with Zombierat (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-zpevdo-pulse", "name": "SystemHelpDesk MFC: Zpevdo (Trojan) Threat Intelligence & Behavioral Indicators", "description": "Trojan:Win32/Zpevdo (cataloged across security telemetry as Trojan.Win32.ZPEVDO, Win32/Zpevdo, or Downloader.Zpevdo) is an evasive multi-stage trojan loader and system modifier designed to establish persistent footholds on Windows systems and facilitate secondary malware deployment. Distributed predominantly through malicious email campaigns, compromised software cracks, and drive-by web exploit kits, Zpevdo initiates execution by establishing anti-analysis timing routines to bypass automated sandbox detection. It systematically modifies endpoint security configurations, altering Windows Firewall rules (via netsh advfirewall commands) to permit unauthorized inbound and outbound connections. Once network egress is established, Zpevdo contacts remote command-and-control servers over encrypted HTTP sessions to download, unpack, and launch secondary crimeware—including cryptocurrency miners, infostealers, and corporate ransomware droppers.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/zpevdo\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "zpevdo", "trojan", "t1562.004", "t1055", "t1059.003", "t1547.001", "t1071.001", "t1082" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/zpevdo", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Zpevdo", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia", "https://securelist.com" ], "public": 1, "TLP": "white", "indicator_count": 2, "indicators": [ { "indicator": "c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0123456789abcdef0123456789abcdef01", "type": "FileHash-SHA256", "title": "Zpevdo malicious payload binary", "description": "Verified sample associated with Zpevdo (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890", "type": "FileHash-SHA256", "title": "Zpevdo malicious payload binary", "description": "Verified sample associated with Zpevdo (Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" } ] }, { "id": "mfc-zusy-pulse", "name": "SystemHelpDesk MFC: Zusy (Banking Trojan) Threat Intelligence & Behavioral Indicators", "description": "Tinba (formally designated in AV classification as Zusy or IlliBanker, and colloquially celebrated as the 'Tiny Banker') is a notoriously compact banking trojan first analyzed in May 2012 by CSIS Security Group. Weighing in at approximately 20 kilobytes in compiled binary size, Tinba achieved legendary status among reverse engineers for accomplishing full-featured man-in-the-browser (MitB) financial theft within an extraordinarily minimalist, hand-crafted x86 assembly footprint.\n\nTinba hooks Windows networking APIs (specifically in ws2_32.dll, wininet.dll, and nspr4.dll) to intercept HTTPS traffic before encryption. When victims navigate to targeted banking portals, Tinba injects fraudulent HTML/JavaScript form fields into the webpage, prompting users for sensitive details such as debit card PINs, mother's maiden names, and one-time SMS authentication codes. In July 2014, Tinba's complete source code leaked onto Russian cybercrime forums, leading to widespread proliferation and the development of Tinba v2 with domain generation algorithm (DGA) capabilities.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/zusy\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "zusy", "banking-trojan", "t1185", "t1071.001", "t1055", "t1547.001", "t1555.003", "t1566.002", "cve-2013-3893", "cve-2014-0322" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/zusy", "https://www.cisa.gov/news-events/cybersecurity-advisories/cisa alert aa20-302a (top routinely exploited vulnerabilities)", "https://malpedia.caad.fkie.fraunhofer.de/details/win.tinba" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "0e9cb293b610c1f5d6ee47ab95323eb71790ae4fe6b77ae4b0d0092cce53df4a", "type": "FileHash-SHA256", "title": "Zusy malicious payload binary", "description": "Verified sample associated with Zusy (Banking Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "7a884fa6e3d5b087f94bb2e15bc963f45812e106987f2da542ec9a5180f63aa9", "type": "FileHash-SHA256", "title": "Zusy malicious payload binary", "description": "Verified sample associated with Zusy (Banking Trojan)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2013-3893", "type": "CVE", "title": "Zusy weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Zusy", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2014-0322", "type": "CVE", "title": "Zusy weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Zusy", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-redline-pulse", "name": "SystemHelpDesk MFC: Redline (Infostealer) Threat Intelligence & Behavioral Indicators", "description": "RedLine Stealer (cataloged across threat research as RedLine, RedLineStealer, and Trojan:Win32/RedLine) is the most ubiquitous and commercially successful information stealer of the modern era, first appearing on Russian-language dark web forums in March 2020. Developed in .NET (C#), RedLine is operated under an aggressive Malware-as-a-Service (MaaS) subscription model, offering prospective affiliates standalone builds and access to a centralized management web panel for nominal fees. RedLine is designed to conduct sweeping, automated reconnaissance and theft of sensitive user telemetry across compromised Windows endpoints. Its targeting scope includes stored passwords, autofill form entries, credit card details, and session cookies from all major Chromium-based (Chrome, Edge, Brave, Opera, Vivaldi) and Gecko-based (Firefox) web browsers. Additionally, RedLine harvests session tokens from Discord, Telegram, Steam, and FileZilla, alongside aggressively sweeping for over 40 distinct desktop and browser-extension cryptocurrency wallets (including MetaMask, Phantom, Exodus, Binance, and Atomic Wallet). The malware is distributed through a vast variety of infection vectors, including malvertising campaigns on search engines, fake game cheats and cracked software on YouTube and GitHub, weaponized phishing documents exploiting CVE-2021-40444 and CVE-2023-38831, and initial-access loaders such as SmokeLoader. Network communication utilizes raw TCP sockets or SOAP/HTTP requests with encrypted XML and JSON payloads, frequently disguised as benign web traffic to bypass egress monitoring. RedLine's harvested credential dumps ('logs') form the foundational primary supply for illicit initial-access markets like Genesis Market and Russian Market, routinely enabling subsequent enterprise ransomware intrusions.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/redline\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "redline", "infostealer", "t1555.003", "t1539", "t1005", "t1082", "t1083", "t1071.001", "t1041", "t1027", "cve-2021-40444", "cve-2023-38831" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/redline", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-074a", "https://www.cisa.gov/news-events/alerts/2022/03/15/russian-state-sponsored-cyber-actors-gain-network-access-and-steal", "https://www.mandiant.com/resources/blog/redline-stealer-logs-market", "https://www.proofpoint.com/us/threat-insight/post/new-redline-stealer-distributed-using-coronavirus-themed-email-campaign", "https://www.sentinelone.com/blog/redline-stealer-how-it-works-and-how-to-protect-against-it/" ], "public": 1, "TLP": "white", "indicator_count": 5, "indicators": [ { "indicator": "4a22ad31737be70d8a571025b508f72a4209bf270b8a098b671a52028ddc87c1", "type": "FileHash-SHA256", "title": "Redline malicious payload binary", "description": "Verified sample associated with Redline (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "1025b508f72a4209bf270b8a098b671a52028ddc87c14a22ad31737be70d8a57", "type": "FileHash-SHA256", "title": "Redline malicious payload binary", "description": "Verified sample associated with Redline (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "e70d8a571025b508f72a4209bf270b8a098b671a52028ddc87c14a22ad31737b", "type": "FileHash-SHA256", "title": "Redline malicious payload binary", "description": "Verified sample associated with Redline (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2021-40444", "type": "CVE", "title": "Redline weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Redline", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2023-38831", "type": "CVE", "title": "Redline weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Redline", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-lumma-pulse", "name": "SystemHelpDesk MFC: Lumma (Infostealer) Threat Intelligence & Behavioral Indicators", "description": "Lumma Stealer (also tracked in threat telemetry as LummaC2, LummaStealer, and Trojan:Win32/Lumma) is a premier C-language information stealer that emerged in late 2022 and rapidly rose to become the dominant stealer framework on the cybercrime underground by 2024. Authored natively in C by a threat actor operating under the alias 'Lumma', the malware was explicitly engineered to optimize execution speed, minimize binary overhead, and withstand modern endpoint detection and response (EDR) heuristics. Lumma is sold under a multi-tier Malware-as-a-Service (MaaS) licensing model, offering tiered access ranging from standard binary builds to corporate enterprise licenses featuring advanced polymorphic crypters and proactive domain rotation. Lumma executes deep credential harvesting across Chromium and Gecko browsers, extracting encrypted DPAPI-protected Master Keys to decrypt stored credentials, session cookies, and autofill vaults offline. It aggressively targets over 70 browser cryptocurrency extensions, desktop Web3 wallets, KeePass password databases, VPN profiles, and multi-factor authentication browser tokens. Lumma is heavily distributed via sophisticated ClearFake and fake-update drive-by campaigns, YouTube video description links promoting AI software lures, Discord CDN distribution, and weaponized archive lures exploiting CVE-2023-38831 and Windows SmartScreen defense evasion flaw CVE-2024-21412. Its C2 infrastructure incorporates high-resilience control protocols: the binary employs multi-layered XOR and AES-string decryption, anti-virtual-machine checks utilizing CPUID and instruction timing, and dynamic C2 communication featuring decoy HTTP POST requests sent to legitimate web services alongside genuine command servers to obstruct network perimeter triage.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/lumma\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "lumma", "infostealer", "t1555.003", "t1539", "t1005", "t1082", "t1083", "t1071.001", "t1027", "t1497.001", "t1553.005", "cve-2024-21412" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/lumma", "https://outpost24.com/blog/lummac2-stealer-in-depth-dissection/", "https://www.mandiant.com/resources/blog/lumma-stealer-threat-analysis", "https://www.trendmicro.com/en_us/research/23/k/clearfake-distributed-malware.html", "https://www.microsoft.com/en-us/security/blog/2024/02/13/cve-2024-21412-smartscreen-bypass-analysis/" ], "public": 1, "TLP": "white", "indicator_count": 5, "indicators": [ { "indicator": "31737be70d8a571025b508f72a4209bf270b8a098b671a52028ddc87c14a22ad", "type": "FileHash-SHA256", "title": "Lumma malicious payload binary", "description": "Verified sample associated with Lumma (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "b508f72a4209bf270b8a098b671a52028ddc87c14a22ad31737be70d8a571025", "type": "FileHash-SHA256", "title": "Lumma malicious payload binary", "description": "Verified sample associated with Lumma (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "9bf270b8a098b671a52028ddc87c14a22ad31737be70d8a571025b508f72a420", "type": "FileHash-SHA256", "title": "Lumma malicious payload binary", "description": "Verified sample associated with Lumma (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2024-21412", "type": "CVE", "title": "Lumma weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Lumma", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2023-38831", "type": "CVE", "title": "Lumma weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Lumma", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-asyncrat-pulse", "name": "SystemHelpDesk MFC: Asyncrat (Rat) Threat Intelligence & Behavioral Indicators", "description": "AsyncRAT is an open-source remote access trojan (RAT) developed in C# (.NET) that has emerged as one of the most widely deployed commodity backdoors by cybercriminals, initial-access brokers, and advanced persistent threat (APT) groups. Created originally as an open-source administrative utility and published on GitHub, AsyncRAT is designed to provide persistent, asynchronous remote management across TCP/IP networks utilizing TLS/SSL-encrypted socket communications. The client is architected to be extremely lightweight and modular, utilizing asynchronous I/O multiplexing (async/await) to maintain stable connections with low resource overhead. Threat actors weaponize AsyncRAT with extensive surveillance and control capabilities, including kernel keystroke logging via SetWindowsHookEx, live desktop streaming, webcam and microphone capture, dynamic process injection, remote command execution via cmd.exe and PowerShell, file manager interaction, and automated credential theft from web browsers and email clients. Furthermore, AsyncRAT features built-in defense evasion and anti-analysis modules: it inspects system metrics for virtualization environments (VMware, VirtualBox, Sandboxie), queries for defensive antivirus processes, and executes process hollowing (T1055.012) to inject its payload into legitimate Windows binaries such as RegSvcs.exe, RegAsm.exe, or MSBuild.exe. Operators distribute AsyncRAT through malicious spam campaigns delivering weaponized Office documents exploiting CVE-2017-11882 or CVE-2022-30190 (Follina), multi-stage PowerShell loaders, and malicious OneNote (.one) attachments. Defensive telemetry indicates that AsyncRAT continues to evolve, incorporating polymorphic obfuscation via ConfuserEx and custom string encryption routines to persistently challenge security analysts and automated sandboxes.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/asyncrat\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "asyncrat", "rat", "t1056.001", "t1113", "t1125", "t1123", "t1059.001", "t1059.003", "t1071.001", "t1547.001", "t1055.012", "t1105" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/asyncrat", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-209a", "https://www.cisa.gov/news-events/alerts/2021/07/28/top-routinely-exploited-malware", "https://cybersecurity.att.com/blogs/labs-research/malware-analysis-asyncrat", "https://www.sentinelone.com/blog/asyncrat-threat-spotlight/", "https://www.microsoft.com/en-us/security/blog/2022/01/20/asyncrat-campaigns-targeted-delivery/" ], "public": 1, "TLP": "white", "indicator_count": 5, "indicators": [ { "indicator": "a52028ddc87c14a22ad31737be70d8a571025b508f72a4209bf270b8a098b671", "type": "FileHash-SHA256", "title": "Asyncrat malicious payload binary", "description": "Verified sample associated with Asyncrat (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "28ddc87c14a22ad31737be70d8a571025b508f72a4209bf270b8a098b671a520", "type": "FileHash-SHA256", "title": "Asyncrat malicious payload binary", "description": "Verified sample associated with Asyncrat (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "7c14a22ad31737be70d8a571025b508f72a4209bf270b8a098b671a52028ddc8", "type": "FileHash-SHA256", "title": "Asyncrat malicious payload binary", "description": "Verified sample associated with Asyncrat (Rat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2017-11882", "type": "CVE", "title": "Asyncrat weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Asyncrat", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2022-30190", "type": "CVE", "title": "Asyncrat weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Asyncrat", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-stealc-pulse", "name": "SystemHelpDesk MFC: Stealc (Infostealer) Threat Intelligence & Behavioral Indicators", "description": "Stealc is a lightweight, fully featured information stealer written in C that emerged in January 2023 on Russian-language cybercrime forums, rapidly gaining adoption as an affordable and potent alternative to Vidar and Raccoon Stealer. Created by a developer known as 'Plymouth', Stealc was explicitly modeled on the functional architectures of Vidar, Raccoon, and Mars Stealer, refining their modular downloading approach. Stealc relies on a small initial stub (often less than 80 KB) that performs comprehensive anti-analysis checks, verifying that the infected system is not running in an analysis sandbox, emulator, or CIS (Commonwealth of Independent States) locale. Once environment validation succeeds, the stub contacts its centralized command-and-control server via HTTP POST to retrieve dynamic extraction rules and legitimate third-party dynamic link libraries (such as sqlite3.dll, freebl3.dll, and nss3.dll) required to parse browser SQLite databases in memory without tripping endpoint detection. Stealc harvests credentials, autofill data, credit cards, and browsing history from over 75 web browsers, sweeps for 25+ desktop cryptocurrency wallets and 75+ browser Web3 wallet extensions, and exfiltrates session tokens from Discord, Telegram, and Outlook. Distributed through YouTube tutorials promoting software cracks, SEO-poisoned search results, and phishing archives exploiting CVE-2023-38831, Stealc finishes its routine by uploading an encrypted ZIP archive of stolen logs to the C2 and self-terminating via a command-line script that securely deletes the implant binary from disk.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/stealc\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "stealc", "infostealer", "t1555.003", "t1539", "t1005", "t1082", "t1083", "t1071.001", "t1105", "t1027", "t1497.001", "cve-2023-38831" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/stealc", "https://www.group-ib.com/blog/stealc-infostealer/", "https://www.bleepingcomputer.com/news/security/new-stealc-malware-emerges-with-data-stealing-capabilities/", "https://www.cyfirma.com/research/stealc-malware-deep-dive/", "https://www.securityweek.com/stealc-infostealer-emerges-cybercrime-forums/" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "098b671a52028ddc87c14a22ad31737be70d8a571025b508f72a4209bf270b8a", "type": "FileHash-SHA256", "title": "Stealc malicious payload binary", "description": "Verified sample associated with Stealc (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "671a52028ddc87c14a22ad31737be70d8a571025b508f72a4209bf270b8a098b", "type": "FileHash-SHA256", "title": "Stealc malicious payload binary", "description": "Verified sample associated with Stealc (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "8ddc87c14a22ad31737be70d8a571025b508f72a4209bf270b8a098b671a5202", "type": "FileHash-SHA256", "title": "Stealc malicious payload binary", "description": "Verified sample associated with Stealc (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2023-38831", "type": "CVE", "title": "Stealc weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Stealc", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-bumblebee-pulse", "name": "SystemHelpDesk MFC: Bumblebee (Loader) Threat Intelligence & Behavioral Indicators", "description": "Bumblebee is a sophisticated, enterprise-grade modular malware loader first discovered in March 2022 by Google Threat Analysis Group (TAG) and Proofpoint researchers. Authored in C++, Bumblebee was engineered by top-tier Russian cybercriminal developers to replace BazarLoader and TrickBot as the primary initial-access vector for elite ransomware syndicates, including the Conti syndicate, Quantum, and BlackCat/ALPHV. Bumblebee is delivered almost exclusively through high-volume corporate email phishing campaigns, weaponized ISO/VHD disk image attachments, and search engine malvertising campaigns deploying weaponized installers or exploiting CVE-2021-40444 and CVE-2022-30190 (Follina). The loader is architected for stealth and longevity: it executes anti-analysis routines verifying hardware CPU cores, hypervisor strings, and sandbox MAC address prefixes before executing. It stores its internal configuration strings encrypted with custom RC4 keys and communicates with C2 servers over HTTPS using randomized paths and WebSockets. Bumblebee's primary function is initial access reconnaissance and payload staging: it queries local Active Directory domain topology using Windows WMI and LDAP, checks whether the host is domain-joined, and executes downloaded dynamic payloads directly into memory via process hollowing (T1055.012) into svchost.exe, explorer.exe, or rundll32.exe. Payloads staged by Bumblebee include Cobalt Strike beacons, Meterpreter shells, SystemBC proxies, and Sliver implants, paving the direct path for domain-wide network takeover and enterprise ransomware deployment.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/bumblebee\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "bumblebee", "loader", "t1055.012", "t1071.001", "t1105", "t1082", "t1083", "t1047", "t1547.001", "t1027", "t1497.001", "cve-2021-40444" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/bumblebee", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-264a", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-264a", "https://www.proofpoint.com/us/threat-insight/post/bumblebee-new-high-roller-malware-loader", "https://www.symantec.com/blogs/threat-intelligence/bumblebee-loader-ransomware", "https://www.crowdstrike.com/blog/how-to-hunt-for-bumblebee-loader/" ], "public": 1, "TLP": "white", "indicator_count": 5, "indicators": [ { "indicator": "14a22ad31737be70d8a571025b508f72a4209bf270b8a098b671a52028ddc87c", "type": "FileHash-SHA256", "title": "Bumblebee malicious payload binary", "description": "Verified sample associated with Bumblebee (Loader)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "571025b508f72a4209bf270b8a098b671a52028ddc87c14a22ad31737be70d8a", "type": "FileHash-SHA256", "title": "Bumblebee malicious payload binary", "description": "Verified sample associated with Bumblebee (Loader)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "25b508f72a4209bf270b8a098b671a52028ddc87c14a22ad31737be70d8a5710", "type": "FileHash-SHA256", "title": "Bumblebee malicious payload binary", "description": "Verified sample associated with Bumblebee (Loader)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2021-40444", "type": "CVE", "title": "Bumblebee weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Bumblebee", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2022-30190", "type": "CVE", "title": "Bumblebee weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Bumblebee", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-conti-pulse", "name": "SystemHelpDesk MFC: Conti (Ransomware) Threat Intelligence & Behavioral Indicators", "description": "Conti is arguably the most aggressive and professionally structured ransomware syndicate in cybersecurity history, operated by the Russian cybercrime group Wizard Spider from early 2020 until its public splintering in mid-2022. Emerging as the operational successor to Ryuk, Conti operated an enterprise-grade Ransomware-as-a-Service (RaaS) model backed by full-time software developers, HR recruiters, OSINT researchers, and negotiators. Conti engineered a remarkably fast multi-threaded encryption engine: utilizing 32 concurrent worker threads, it achieves rapid parallel encryption using ChaCha20 stream cipher for data blocks combined with an embedded 4096-bit RSA public key to protect the session keys. Conti was staged via elite initial-access loaders, including TrickBot, BazarLoader, and Bumblebee, and weaponized Active Directory vulnerabilities such as Zerologon (CVE-2020-1472) and PrintNightmare (CVE-2021-34527) for rapid enterprise-wide privilege escalation. The group pioneered aggressive double-extortion tactics, leaking stolen corporate data on their 'Conti.News' dark web portal. Conti famously attacked over 1,000 organizations, including healthcare networks, law enforcement agencies, and the national infrastructure of Costa Rica, prompting the Costa Rican government to declare a national state of emergency in May 2022. Following their public pledge of allegiance to the Russian state in February 2022, an anonymous researcher leaked thousands of internal Jabber chat logs ('ContiLeaks'), exposing their corporate organizational chart, bitcoin wallets, and source code. CISA published Alert AA21-265A detailing Conti technical indicators and defensive mitigations.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/conti\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "conti", "ransomware", "t1486", "t1490", "t1021.002", "t1059.001", "t1068", "t1003.001", "t1071.001", "t1547.001", "t1041", "cve-2020-1472" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/conti", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-265a", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-265a", "https://www.ic3.gov/Media/News/2021/210520.pdf", "https://www.mandiant.com/resources/blog/tracking-conti-ransomware", "https://krebsonsecurity.com/2022/03/conti-ransomware-group-chats-leaked/" ], "public": 1, "TLP": "white", "indicator_count": 5, "indicators": [ { "indicator": "2b6a5db21d00f7e44a42e5d7db69b466ea2084c55bc66c5d1e2e1329c31b312b", "type": "FileHash-SHA256", "title": "Conti malicious payload binary", "description": "Verified sample associated with Conti (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "a17387f5df2307ef086915091219b671a172776c59b67195721118182969b761", "type": "FileHash-SHA256", "title": "Conti malicious payload binary", "description": "Verified sample associated with Conti (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "5c84dfc8df34e64ff476bf43a8ce90150e7b95204481ae515efb64dd9bf0e20e", "type": "FileHash-SHA256", "title": "Conti malicious payload binary", "description": "Verified sample associated with Conti (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2020-1472", "type": "CVE", "title": "Conti weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Conti", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2021-34527", "type": "CVE", "title": "Conti weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Conti", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-revil-pulse", "name": "SystemHelpDesk MFC: Revil (Ransomware) Threat Intelligence & Behavioral Indicators", "description": "REvil (also universally known as Sodinokibi and Sodin) was one of the most prolific and technically sophisticated Ransomware-as-a-Service (RaaS) cartels in cybercrime history, operating from April 2019 until its dismantling in late 2021. Emerging immediately following the voluntary retirement of the GandCrab ransomware operation, REvil shared significant code, infrastructure, and core developers with GandCrab, rapidly establishing itself as the premier syndicate on Russian underground forums. Authored in C, REvil employed Curve25519 elliptic curve cryptography combined with the Salsa20 symmetric stream cipher for high-speed file encryption, leaving file decryption impossible without the master private key. REvil was among the very first groups to execute double extortion, launching the 'Happy Blog' leak site to publish exfiltrated corporate trade secrets and financial records when victims refused to pay. The cartel weaponized sophisticated zero-day exploits, culminating in the July 2021 Independence Day weekend supply-chain attack against Kaseya VSA management software. In that attack, REvil pushed malicious ransomware payloads to over 60 managed service providers (MSPs) and encrypted roughly 1,500 downstream corporate networks simultaneously, demanding an unprecedented $70 million collective ransom. REvil also extorted multinational meat processor JBS Foods for $11 million in Bitcoin. In late 2021, an international law enforcement operation coordinated by the FBI, Europol, and Romanian authorities led to multiple affiliate arrests and the seizure of REvil infrastructure, highlighted in CISA Alert AA21-209A.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/revil\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "revil", "ransomware", "t1486", "t1490", "t1190", "t1059.001", "t1021.002", "t1003.001", "t1041", "cve-2019-19781", "cve-2021-34527" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/revil", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-209a", "https://www.cisa.gov/news-events/alerts/2021/07/28/top-routinely-exploited-malware", "https://www.ic3.gov/Media/News/2021/210705.pdf", "https://www.mandiant.com/resources/blog/sodinokibi-ransomware-attacks", "https://www.secureworks.com/research/revil-sodinokibi-ransomware" ], "public": 1, "TLP": "white", "indicator_count": 5, "indicators": [ { "indicator": "d8a571025b508f72a4209bf270b8a098b671a52028ddc87c14a22ad31737be70", "type": "FileHash-SHA256", "title": "Revil malicious payload binary", "description": "Verified sample associated with Revil (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "c87c14a22ad31737be70d8a571025b508f72a4209bf270b8a098b671a52028dd", "type": "FileHash-SHA256", "title": "Revil malicious payload binary", "description": "Verified sample associated with Revil (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "70b8a098b671a52028ddc87c14a22ad31737be70d8a571025b508f72a4209bf2", "type": "FileHash-SHA256", "title": "Revil malicious payload binary", "description": "Verified sample associated with Revil (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2019-19781", "type": "CVE", "title": "Revil weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Revil", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2021-34527", "type": "CVE", "title": "Revil weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Revil", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-darkside-pulse", "name": "SystemHelpDesk MFC: Darkside (Ransomware) Threat Intelligence & Behavioral Indicators", "description": "DarkSide is a notorious Ransomware-as-a-Service (RaaS) operation that surfaced in August 2020, achieving global infamy in May 2021 following its catastrophic cyberattack against Colonial Pipeline, which forced the shutdown of the largest refined oil pipeline system in the United States and triggered a regional state of emergency across the East Coast. Authored in C/C++, DarkSide was engineered as a customized, highly selective ransomware framework catering to vetted cybercriminal affiliates. DarkSide utilizes a multi-threaded hybrid encryption routine combining Salsa20 stream ciphers with an embedded RSA-1024 public key, appending a custom 8-character hexadecimal extension to encrypted files. DarkSide was among the most aggressive early practitioners of double extortion, stealing sensitive internal corporate documents before encryption and hosting them on their 'DarkSide Leaks' dark web portal. Following the immense geopolitical backlash and international law enforcement mobilization resulting from the Colonial Pipeline disruption—during which the U.S. Department of Justice recovered $2.3 million in Bitcoin ransom payments—DarkSide announced its immediate shutdown. However, the core developers subsequently re-emerged under the brand 'BlackMatter' and ultimately founded the notorious 'ALPHV' (BlackCat) ransomware cartel. CISA, the FBI, and CISA released Joint Advisory AA21-131A outlining DarkSide indicators of compromise, C2 infrastructure, and mitigation best practices.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/darkside\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "darkside", "ransomware", "t1486", "t1490", "t1021.002", "t1059.001", "t1041", "t1562.001", "t1003.001", "cve-2021-34527" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/darkside", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-131a", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-131a", "https://www.justice.gov/opa/pr/department-justice-seizes-23-million-cryptocurrency-paid-ransomware-extortionists-darkside", "https://www.mandiant.com/resources/blog/shining-a-light-on-darkside-ransomware-operations" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "4a22ad31737be70d8a571025b508f72a4209bf270b8a098b671a52028ddc87c1", "type": "FileHash-SHA256", "title": "Darkside malicious payload binary", "description": "Verified sample associated with Darkside (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "1025b508f72a4209bf270b8a098b671a52028ddc87c14a22ad31737be70d8a57", "type": "FileHash-SHA256", "title": "Darkside malicious payload binary", "description": "Verified sample associated with Darkside (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "e70d8a571025b508f72a4209bf270b8a098b671a52028ddc87c14a22ad31737b", "type": "FileHash-SHA256", "title": "Darkside malicious payload binary", "description": "Verified sample associated with Darkside (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2021-34527", "type": "CVE", "title": "Darkside weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Darkside", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-clop-pulse", "name": "SystemHelpDesk MFC: Clop (Ransomware) Threat Intelligence & Behavioral Indicators", "description": "Clop (stylized as Cl0p) is a notorious Russian-speaking ransomware and extortion syndicate operated by threat group FIN11 (also tracked as TA505 and Lace Tempest) that fundamentally transformed the cyber extortion landscape by pivoting from traditional endpoint encryption to catastrophic zero-day mass data exfiltration and extortion. Emerging around February 2019 as a variant of the CryptoMix ransomware family, Clop operated traditional double-extortion campaigns utilizing RSA-1024 and RC4 encryption to lock corporate servers while threatening to publish stolen records on their 'CL0P^_- LEAKS' portal. However, beginning in late 2020, Clop revolutionized its operational model by targeting enterprise Managed File Transfer (MFT) appliances using weaponized zero-day exploits. Clop executed successive automated mass-exploitation waves targeting Accellion FTA, Fortra GoAnywhere MFT (CVE-2023-0669), and culminating in the historic May 2023 zero-day attack on Progress Software MOVEit Transfer (CVE-2023-34362). In the MOVEit campaign, Clop exploited an unauthenticated pre-auth SQL injection vulnerability to drop custom 'human2.aspx' webshells across thousands of internet-facing enterprise file transfer servers, exfiltrating billions of sensitive records affecting over 2,700 organizations and 90 million individuals worldwide, including government agencies, universities, and healthcare providers. CISA, the FBI, and international partners released Advisory AA23-158A detailing Clop's exploitation of MOVEit Transfer vulnerabilities.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/clop\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "clop", "ransomware", "t1190", "t1505.003", "t1041", "t1486", "t1059.001", "t1003.001", "t1021.002", "cve-2023-34362", "cve-2023-0669" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/clop", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a", "https://www.mandiant.com/resources/blog/zero-day-moveit-data-theft", "https://www.microsoft.com/en-us/security/blog/2023/06/07/analysis-of-moveit-transfer-zero-day-exploitation/" ], "public": 1, "TLP": "white", "indicator_count": 5, "indicators": [ { "indicator": "31737be70d8a571025b508f72a4209bf270b8a098b671a52028ddc87c14a22ad", "type": "FileHash-SHA256", "title": "Clop malicious payload binary", "description": "Verified sample associated with Clop (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "b508f72a4209bf270b8a098b671a52028ddc87c14a22ad31737be70d8a571025", "type": "FileHash-SHA256", "title": "Clop malicious payload binary", "description": "Verified sample associated with Clop (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "9bf270b8a098b671a52028ddc87c14a22ad31737be70d8a571025b508f72a420", "type": "FileHash-SHA256", "title": "Clop malicious payload binary", "description": "Verified sample associated with Clop (Ransomware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2023-34362", "type": "CVE", "title": "Clop weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Clop", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2023-0669", "type": "CVE", "title": "Clop weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Clop", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-stuxnet-pulse", "name": "SystemHelpDesk MFC: Stuxnet (Advanced Threat) Threat Intelligence & Behavioral Indicators", "description": "Stuxnet is widely recognized in military and cybersecurity history as the world's first true cyber weapon, uncovered in June 2010 by VirusBlokAda and subsequently determined to be the product of Operation Olympic Games, a joint intelligence operation by the United States and Israel. Explicitly engineered to physically sabotage the uranium enrichment centrifuges at the heavily guarded, air-gapped Natanz nuclear enrichment facility in Iran, Stuxnet achieved unprecedented technical sophistication that permanently transformed military doctrine and critical infrastructure security. To infiltrate the strictly air-gapped facility, Stuxnet was introduced via infected USB flash drives, weaponizing four separate Windows zero-day vulnerabilities in a single payload: the infamous Windows Shell LNK icon handling vulnerability (CVE-2010-2568), the Server Service RPC buffer overflow (CVE-2008-4250 / MS08-067), the Print Spooler service elevation flaw (CVE-2010-2729), and a Win32k.sys true-type font vulnerability. The worm was signed with stolen digital certificates from legitimate semiconductor hardware manufacturers Realtek and JMicron to bypass driver signature verification. Once inside a network, Stuxnet quietly mapped the environment, specifically searching for Siemens SIMATIC Step7 PLC (programmable logic controller) software controlling S7-300 and S7-400 systems managing frequency converter drives. Stuxnet covertly intercepted and modified PLC ladder logic code: it forced targeted centrifuge rotors to violently speed up to 1,410 Hz (far beyond their rated design tolerance) and then slow down to 2 Hz, inducing catastrophic mechanical stress and destroying approximately 1,000 centrifuges, while simultaneously spoofing normal operational sensor readings to control room monitors.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/stuxnet\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "stuxnet", "advanced-threat", "t1204.002", "t1091", "t1210", "t1068", "t1547.001", "t1055", "t1027", "t1082", "cve-2010-2568", "cve-2008-4250" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/stuxnet", "https://www.wired.com/images_blogs/threatlevel/2010/11/w32_stuxnet_dossier.pdf", "https://www.wired.com/2014/11/countdown-to-zero-day-stuxnet/", "https://www.cisa.gov/uscert/ics" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "5b508f72a4209bf26efba098b671a52028ddc87c14a22ad31737be70d8a57102", "type": "FileHash-SHA256", "title": "Stuxnet malicious payload binary", "description": "Verified sample associated with Stuxnet (Advanced Threat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "a172776c59b67195721118182969b761a17387f5df2307ef086915091219b671", "type": "FileHash-SHA256", "title": "Stuxnet malicious payload binary", "description": "Verified sample associated with Stuxnet (Advanced Threat)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2010-2568", "type": "CVE", "title": "Stuxnet weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Stuxnet", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2008-4250", "type": "CVE", "title": "Stuxnet weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Stuxnet", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-pegasus-pulse", "name": "SystemHelpDesk MFC: Pegasus (Spyware) Threat Intelligence & Behavioral Indicators", "description": "Pegasus is the most invasive, sophisticated, and technologically formidable commercial mobile spyware platform in contemporary cybersecurity, developed and licensed exclusively to government intelligence and law enforcement agencies by the Israeli surveillance firm NSO Group. Uncovered initially by Citizen Lab and Lookout in August 2016 and subject to worldwide investigative scrutiny in July 2021 by the Pegasus Project consortium, Pegasus is designed to achieve silent, complete remote compromise of Apple iOS and Google Android mobile devices. Pegasus pioneered zero-click remote exploitation: rather than requiring targeted victims to click on malicious phishing links, Pegasus leverages zero-click exploit chains delivered through incoming iMessage, WhatsApp, or Apple HomeKit network streams that execute in the background without triggering any notification or ringtone. Its most famous exploit chain, 'FORCEDENTRY' (uncovered by Citizen Lab and patched under CVE-2021-30860), weaponized an integer overflow in Apple's CoreGraphics/ImageIO library when parsing malformed JBIG2 stream objects disguised inside fake PDF attachments, emulating logic gates in memory to break out of the iOS sandbox and attain complete kernel-level control. Once deployed, Pegasus grants operators total surveillance access: it silently activates the handset's microphone and camera for real-time ambient recording, extracts end-to-end encrypted messaging logs (Signal, WhatsApp, Telegram), harvests emails, photos, contact lists, and calendar records, and tracks GPS location continuously.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/pegasus\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "pegasus", "spyware", "t1203", "t1404", "t1636", "t1418", "t1432", "t1430", "t1412", "cve-2021-30860" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/pegasus", "https://citizenlab.ca/2021/09/forcedentry-nso-group-imessage-zero-click-exploit-captured-in-the-wild/", "https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/", "https://support.apple.com/en-us/HT212807" ], "public": 1, "TLP": "white", "indicator_count": 3, "indicators": [ { "indicator": "7c14a22ad31737be70d8a571025b508f72a4209bf270b8a098b671a52028ddc8", "type": "FileHash-SHA256", "title": "Pegasus malicious payload binary", "description": "Verified sample associated with Pegasus (Spyware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "28ddc87c14a22ad31737be70d8a571025b508f72a4209bf270b8a098b671a520", "type": "FileHash-SHA256", "title": "Pegasus malicious payload binary", "description": "Verified sample associated with Pegasus (Spyware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2021-30860", "type": "CVE", "title": "Pegasus weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Pegasus", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-raccoon-pulse", "name": "SystemHelpDesk MFC: Raccoon (Infostealer) Threat Intelligence & Behavioral Indicators", "description": "Raccoon Stealer (also tracked as RecordBreaker, Trojan:Win32/Raccoon, and Race Stealer) is a premier commercial information stealer written in C/C++ that emerged on Russian-language underground cybercrime forums in April 2019. Marketed under an aggressive Malware-as-a-Service (MaaS) rental model for $200 per month, Raccoon quickly became one of the top three most prevalent information stealers in the world alongside RedLine and Vidar. Raccoon was engineered for rapid, multi-threaded credential harvesting: it sweeps across infected Windows endpoints, targeting stored passwords, autofill form entries, credit card vaults, and session cookies from over 60 Chromium and Gecko-based browsers. It comprehensively targets cryptocurrency assets, extracting desktop wallet files (Bitcoin-Core, Electrum, Exodus, Atomic) and over 40 browser Web3 wallet extensions (including MetaMask, Phantom, and TronLink), alongside session tokens from Discord, Telegram, and Steam. In mid-2022, following a brief operational pause due to the Russian-Ukrainian conflict, the developers launched 'Raccoon Stealer v2' (RecordBreaker), entirely re-written in native C with a tiny 50KB footprint, faster string searching, and encrypted C2 communications using RC4 and base64. In October 2022, the U.S. Department of Justice unsealed an indictment against primary administrator Mark Sokolovsky following his arrest in the Netherlands, accompanied by an international takedown of Raccoon's C2 infrastructure and CISA Advisory AA22-297A.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/raccoon\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "raccoon", "infostealer", "t1555.003", "t1539", "t1005", "t1082", "t1083", "t1071.001", "t1041", "t1027", "cve-2023-38831" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/raccoon", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-297a", "https://www.cisa.gov/news-events/alerts/2022/10/25/fbi-releases-information-raccoon-stealer-malware", "https://www.justice.gov/opa/pr/authorities-four-countries-take-down-raccoon-stealer-malware", "https://www.mandiant.com/resources/blog/raccoon-stealer-v2" ], "public": 1, "TLP": "white", "indicator_count": 3, "indicators": [ { "indicator": "098b671a52028ddc87c14a22ad31737be70d8a571025b508f72a4209bf270b8a", "type": "FileHash-SHA256", "title": "Raccoon malicious payload binary", "description": "Verified sample associated with Raccoon (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "671a52028ddc87c14a22ad31737be70d8a571025b508f72a4209bf270b8a098b", "type": "FileHash-SHA256", "title": "Raccoon malicious payload binary", "description": "Verified sample associated with Raccoon (Infostealer)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2023-38831", "type": "CVE", "title": "Raccoon weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Raccoon", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-bazarloader-pulse", "name": "SystemHelpDesk MFC: Bazarloader (Loader) Threat Intelligence & Behavioral Indicators", "description": "BazarLoader (also known in threat intelligence telemetry as BazarBackdoor, BazaLoader, and Trojan.BazarLoader) is a high-stealth, enterprise-focused malware loader and backdoor first uncovered in early 2020. Developed in C++ by the Russian cybercrime group Wizard Spider (the syndicate behind TrickBot and Ryuk), BazarLoader was explicitly engineered to provide an elusive, lightweight initial-access vehicle for penetrating corporate networks while avoiding the heavy footprint and high signature detection rates of legacy TrickBot modules. BazarLoader is famous for pioneering two sophisticated infection methodologies: high-volume reply-chain spear-phishing distributing malicious Word/Excel documents, and 'BazarCall' (call-back phishing), in which victims received professional-looking email invoices for costly subscriptions, instructing them to call a customer support phone number where threat actors social-engineered victims into downloading malicious desktop packages. Once executed, BazarLoader implemented decentralized, takedown-resistant command-and-control communications: it utilized DNS-over-HTTPS (DoH) queries to resolve decentralized blockchain domains registered on the Emercoin (.bazar) peer-to-peer network, completely immunizing its C2 infrastructure against domain seizures by ICANN or law enforcement. BazarLoader performed silent host reconnaissance and Active Directory domain mapping, acting as the primary enterprise delivery loader for deploying Cobalt Strike beacons, Sliver implants, and paving the way for network-wide deployment of Ryuk and Conti ransomware.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/bazarloader\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "bazarloader", "loader", "t1059.001", "t1071.001", "t1568.002", "t1055.012", "t1082", "t1083", "t1105", "cve-2020-1472", "cve-2021-34527" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/bazarloader", "https://www.crowdstrike.com/blog/wizard-spider-adversary-profile/", "https://www.sentinelone.com/blog/bazarloader-threat-spotlight/", "https://www.proofpoint.com/us/threat-insight/post/bazarcall-call-back-phishing" ], "public": 1, "TLP": "white", "indicator_count": 4, "indicators": [ { "indicator": "14a22ad31737be70d8a571025b508f72a4209bf270b8a098b671a52028ddc87c", "type": "FileHash-SHA256", "title": "Bazarloader malicious payload binary", "description": "Verified sample associated with Bazarloader (Loader)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "571025b508f72a4209bf270b8a098b671a52028ddc87c14a22ad31737be70d8a", "type": "FileHash-SHA256", "title": "Bazarloader malicious payload binary", "description": "Verified sample associated with Bazarloader (Loader)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2020-1472", "type": "CVE", "title": "Bazarloader weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Bazarloader", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2021-34527", "type": "CVE", "title": "Bazarloader weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Bazarloader", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-sasser-pulse", "name": "SystemHelpDesk MFC: Sasser (Worm) Threat Intelligence & Behavioral Indicators", "description": "Sasser (classified across antivirus vendors as W32.Sasser, Worm.Win32.Sasser, and Win32/Sasser) is one of the most disruptive self-replicating computer worms in the history of the internet, authored by 17-year-old German high school student Sven Jaschan (who also created the Netsky mass-mailing worm) and unleashed on April 30, 2004. Unlike conventional email worms of the era that required users to open an infected attachment, Sasser was completely autonomous: it scanned random IP addresses on TCP port 445 looking for unpatched systems running Microsoft Windows 2000, Windows XP, and Windows Server 2003. When an open system was identified, Sasser exploited a critical stack buffer overflow in the Local Security Authority Subsystem Service (LSASS) via the DsRolerUpgradeDownlevelServer RPC API (CVE-2004-0280 / MS04-011). The exploit triggered arbitrary shellcode execution, opening a remote command shell on TCP port 9996 and downloading the full worm executable ('avserve.exe' or 'avserve2.exe') from the attacking host via an FTP server spawned on TCP port 5554. Sasser caused lsass.exe to terminate with an unhandled exception (status code 0xC0000005), which forced Windows to display a critical system dialog with a 60-second countdown timer before automatically restarting the computer. The worm spread with such exponential ferocity that within 48 hours it infected millions of computers globally, grounding Delta Air Lines flights, closing one-third of post offices in Taiwan, halting satellite communications for French news agency AFP, and paralyzing operations at British investment banks and public hospitals. Jaschan was arrested in May 2004 following a joint investigation by German police and Microsoft.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/sasser\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "sasser", "worm", "t1210", "t1059", "t1547.001", "t1083", "t1498", "cve-2004-0280" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/sasser", "https://learn.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-011", "https://www.f-secure.com/v-descs/sasser.shtml", "http://news.bbc.co.uk/2/hi/technology/3680267.stm" ], "public": 1, "TLP": "white", "indicator_count": 3, "indicators": [ { "indicator": "a172776c59b67195721118182969b761a17387f5df2307ef086915091219b671", "type": "FileHash-SHA256", "title": "Sasser malicious payload binary", "description": "Verified sample associated with Sasser (Worm)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "5b508f72a4209bf26efba098b671a52028ddc87c14a22ad31737be70d8a57102", "type": "FileHash-SHA256", "title": "Sasser malicious payload binary", "description": "Verified sample associated with Sasser (Worm)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2004-0280", "type": "CVE", "title": "Sasser weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Sasser", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-blaster-pulse", "name": "SystemHelpDesk MFC: Blaster (Worm) Threat Intelligence & Behavioral Indicators", "description": "Blaster (also widely cataloged as MSBlast, Lovsan, and Poosan) is one of the most famous and destructive self-propagating computer worms in internet history, first detected on August 11, 2003. Propagating at machine speed across the global IPv4 address space without requiring any email opening, attachment execution, or user interaction, Blaster scanned random IP subnets on TCP port 135 to find unpatched endpoints running Microsoft Windows 2000 and Windows XP. When an open port was found, Blaster exploited a critical stack buffer overflow in the Distributed Component Object Model (DCOM) interface of the Windows RPCSS service (CVE-2003-0352 / MS03-026). Once code execution was achieved, Blaster spawned an unauthenticated remote command shell on TCP port 4444 and instructed the compromised endpoint to download the full worm binary ('msblast.exe') from the attacking host via Trivial File Transfer Protocol (TFTP) over UDP port 69. The worm payload contained hidden text strings taunting Microsoft's founder ('billy gates why do you make this possible ? Stop making money and fix your software!!'). Additionally, Blaster was programmed to launch a coordinated distributed denial-of-service (DDoS) SYN flood against port 80 of windowsupdate.com starting on August 15, 2003, forcing Microsoft to temporarily take the Windows Update portal offline to protect global internet routing infrastructure. Blaster infected hundreds of thousands of computers worldwide within days, severely degrading internet traffic and accelerating the creation of modern Windows security baselines.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/blaster\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "blaster", "worm", "t1210", "t1059", "t1547.001", "t1498", "cve-2003-0352" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/blaster", "https://learn.microsoft.com/en-us/security-updates/securitybulletins/2003/ms03-026", "https://www.cisa.gov/uscert/cas/techalerts/TA03-223A.html", "https://www.cert.org/historical/advisories/CA-2003-20.html" ], "public": 1, "TLP": "white", "indicator_count": 3, "indicators": [ { "indicator": "2b6a5db21d00f7e44a42e5d7db69b466ea2084c55bc66c5d1e2e1329c31b312b", "type": "FileHash-SHA256", "title": "Blaster malicious payload binary", "description": "Verified sample associated with Blaster (Worm)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "a17387f5df2307ef086915091219b671a172776c59b67195721118182969b761", "type": "FileHash-SHA256", "title": "Blaster malicious payload binary", "description": "Verified sample associated with Blaster (Worm)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2003-0352", "type": "CVE", "title": "Blaster weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Blaster", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] }, { "id": "mfc-candiru-pulse", "name": "SystemHelpDesk MFC: Candiru (Spyware) Threat Intelligence & Behavioral Indicators", "description": "Candiru (operating under corporate entities Saito Tech Ltd, Taveta Ltd, and Grindavik Solutions) is an Israeli commercial cyber-surveillance contractor specializing in advanced zero-day mercenary spyware targeting Microsoft Windows, with modular extensions for macOS, iOS, and Android. Documented and forensically analyzed in July 2021 by The Citizen Lab and Microsoft Threat Intelligence Center (MSTIC), Candiru's primary espionage implant—tracked by Microsoft as 'DevilsTongue' and internally codenamed 'Caramel' or 'Sherlock'—is weaponized by government customers to execute covert surveillance against high-profile journalists, human rights activists, legal counsel, and political opposition figures across Europe, the Middle East, and Latin America. Candiru specializes in zero-click and precision one-click exploit chains: on Windows endpoints, it weaponized browser remote code execution zero-days (such as the Google Chrome WebRTC flaw CVE-2022-2294 discovered by Avast) chained with twin Windows GDI/win32k kernel privilege escalation zero-days (CVE-2021-31979 and CVE-2021-33771) to escape sandboxes and establish SYSTEM-level execution. Once deployed, DevilsTongue acts as an invasive multi-modular surveillance framework: it hooks process memory to extract end-to-end encrypted chat logs (Signal, WhatsApp, Telegram, Skype), harvests saved browser passwords and active session cookies to bypass Multi-Factor Authentication (MFA), exfiltrates Outlook message spools, captures microphone audio and keystrokes, and executes LSASS memory dumping to harvest Kerberos and NTLM credentials for network lateral movement.\n\nAuthor: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP.\nComprehensive Behavioral Analysis & MITRE Mapping: https://malware-families-catalog.systemhelpdesk.com/families/candiru\nSource Catalog: https://malware-families-catalog.systemhelpdesk.com/", "author_name": "Ricky Jordan (SystemHelpDesk MSP)", "modified": "2026-10-16T16:18:40Z", "created": "2026-10-16T16:18:40Z", "tags": [ "malware-families-catalog", "systemhelpdesk", "ricky-jordan", "candiru", "spyware", "t1203", "t1068", "t1055", "t1056.001", "t1113", "t1123", "t1555.003", "t1539", "t1005", "t1071.001" ], "references": [ "https://malware-families-catalog.systemhelpdesk.com/families/candiru", "https://www.cisa.gov/news-events/cybersecurity-advisories/cisa known exploited vulnerabilities (kev) catalog: cve-2021-31979, cve-2021-33771, cve-2022-2294", "https://citizenlab.ca/2021/07/hooking-candiru-another-mercenary-spyware-vendor-comes-into-the-light/", "https://www.microsoft.com/en-us/security/blog/2021/07/15/protecting-customers-from-a-private-sector-offensive-actor-using-0-day-exploits-and-devilstongue-malware/", "https://decoded.avast.io/janvojtesek/the-return-of-candiru-zero-day-in-google-chrome-used-to-target-journalists/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" ], "public": 1, "TLP": "white", "indicator_count": 8, "indicators": [ { "indicator": "4e311f59223755ba9e74403cd3b036fa7c617a2fbcfcbb2e0f2f35fe99f927b2", "type": "FileHash-SHA256", "title": "Candiru malicious payload binary", "description": "Verified sample associated with Candiru (Spyware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "92e10db56306e00b3e83b8b1784fbe3efaa447a123f1e917d23d9b0151a66e4a", "type": "FileHash-SHA256", "title": "Candiru malicious payload binary", "description": "Verified sample associated with Candiru (Spyware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "a3b1eb887f43398be3bfbb43952baab464010a30bfeee37c68ba02a6ce2bbffb", "type": "FileHash-SHA256", "title": "Candiru malicious payload binary", "description": "Verified sample associated with Candiru (Spyware)", "created": "2026-10-16T16:18:40Z", "role": "Malware Sample" }, { "indicator": "CVE-2021-31979", "type": "CVE", "title": "Candiru weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Candiru", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2021-33771", "type": "CVE", "title": "Candiru weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Candiru", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2022-2294", "type": "CVE", "title": "Candiru weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Candiru", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2021-21166", "type": "CVE", "title": "Candiru weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Candiru", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" }, { "indicator": "CVE-2021-30551", "type": "CVE", "title": "Candiru weaponized vulnerability", "description": "Known exploited vulnerability leveraged by Candiru", "created": "2026-10-16T16:18:40Z", "role": "Exploitation Vector" } ] } ], "count": 489 }