T1185: Browser Session Hijacking (Ad injection and tracking)
Operational Executive Summary
T1185 (Browser Session Hijacking (Ad injection and tracking)) is classified under the Collection tactic within the MITRE ATT&CK framework. Adversary tradecraft focused on gathering sensitive files, keystrokes, screen captures, audio, and database records prior to exfiltration. In telemetry gathered across enterprise endpoints and the EMBER 2018 benchmark, this technique was weaponized across 152 distinct malware families, totaling over 51,140 validated samples.
Technical Anatomy & Adversary Tradecraft
Adversaries leverage Browser Session Hijacking (Ad injection and tracking) to accomplish operational objectives while minimizing anomalous forensic footprints. When executing Browser Session Hijacking (Ad injection and tracking), malicious binaries commonly interact directly with low-level Windows APIs, kernel mode drivers, or native scripting interfaces to bypass traditional file-integrity monitors and static antivirus signatures.
In modern multi-stage campaigns, T1185 is frequently observed functioning as an intermediate bridge: initial access payloads (such as spearphishing loaders or exploit macros) execute Browser Session Hijacking (Ad injection and tracking) to establish in-memory execution or persistence before staging secondary ransomware or data-exfiltration implants.
Authoritative MITRE ATT&CK Reference: View official technique documentation, sub-techniques, and adversary groups at
https://attack.mitre.org/techniques/T1185/.
Detection Engineering & Threat Hunting
Detecting Browser Session Hijacking (Ad injection and tracking) requires telemetry correlation across endpoint detection and response (EDR) agents, Sysmon event streams, and security information event management (SIEM) pipelines:
- Process Creation & Lineage: Monitor parent-child process anomalies where unexpected parent binaries (e.g., Office executables, web browsers, or script hosts) spawn command shells or native Windows utilities.
- API Hooking & Behavioral Telemetry: EDR platforms should flag rapid calls to memory allocation, process injection, or registry manipulation APIs originating from unbacked executable memory regions.
- Network Anomaly Correlation: Cross-reference endpoint execution timestamps with external network socket establishment to identify anomalous beaconing or covert data staging.
SOC Containment & Hardening Guidance
To mitigate risks associated with T1185 (Browser Session Hijacking (Ad injection and tracking)) across production infrastructure, security teams should implement the following defensive controls:
- Attack Surface Reduction (ASR): Enforce strict application control policies (WDAC or AppLocker) to restrict execution to signed and verified corporate binaries.
- Least Privilege & Credential Hygiene: Restrict local administrative privileges to prevent adversaries from tampering with defensive agents or escalating privileges.
- Network Microsegmentation: Restrict lateral communication across endpoint VLANs to prevent wormable payloads from utilizing Browser Session Hijacking (Ad injection and tracking) across adjacent network segments.
Cataloged Malware Families Utilizing T1185 (152 Families)
The following malware families in the SystemHelpDesk catalog have been verified utilizing T1185 (Browser Session Hijacking (Ad injection and tracking)):
152 families
| Family | Category | Sample Count | Technical Summary |
|---|---|---|---|
| ramnit | Worm Banker | 20,595 | Ramnit (also known as Nimnul or Cosmu) is a devastating, multi-faceted banking trojan and worm that first emerged in 2010. Originally conceived as a Windows fil... |
| zusy | Banking Trojan | 14,120 | Tinba (formally designated in AV classification as Zusy or IlliBanker, and colloquially celebrated as the 'Tiny Banker') is a notoriously compact banking trojan... |
| ursnif | Banking Trojan | 8,188 | Ursnif (also widely known by its underlying codebase names Gozi and ISFB) is one of the most enduring and technically sophisticated banking trojans and modular ... |
| virut | File Infector | 1,578 | Virut (also tracked as Virux or W32/Virut) is one of the most destructive, technically complex, and resilient polymorphic file infectors and botnets in cybersec... |
| tinba | Banking Trojan | 1,531 | Trojan:Win32/Tinba (short for 'Tiny Banker', also cataloged by vendors as Zusy) is a landmark banking trojan famous for its remarkably micro-sized footprint—com... |
| downloadhelper | Adware | 645 | DownloadHelper (cataloged across commercial antivirus telemetry as Adware:Win32/DownloadHelper, PUA.DownloadHelper, and Adware.Toolbar.DownloadHelper) is an int... |
| byfh | Trojan | 593 | Byfh (tracked as Trojan:Win32/Byfh!rfn, Trojan.Byfh, and Adware:Win32/Byfh) is a persistent Windows trojan downloader and monetization platform analyzed by Micr... |
| zamg | Trojan | 527 | Zamg (cataloged across security intelligence as Trojan:Win32/Zamg, Trojan.Mint.Zamg, and Trojan:Win32/Zamg.A!bit) is a covert Windows trojan loader and payload ... |
| wizzmonetize | Adware | 515 | WizzMonetize (also tracked across threat intelligence feeds as Adware:Win32/WizzMonetize, PUA:Win32/WizzMonetize, and Adware.MonetizeInstaller) is an aggressive... |
| koobface | Worm | 350 | Koobface (an anagram of 'Facebook') was the definitive pioneer of social-network worm and botnet operations, reigning as one of the most prolific and profitable... |
| expiro | File Infector | 305 | Expiro (classified across security vendors as Virus:Win32/Expiro, Virus:Win64/Expiro, and Xpiro) is one of the most sophisticated, long-lived polymorphic cross-... |
| shiz | Banking Trojan | 302 | Trojan-Banker:Win32/Shiz is a notorious, historically significant Russian banking trojan that served as a critical evolutionary link connecting early Zeus and G... |
| blackmoon | Banking Trojan | 228 | Trojan:Win32/Blackmoon (widely designated in cybersecurity research as KRBanker) is a destructive, regionally focused banking trojan that emerged in 2014, speci... |
| wajam | Adware | 131 | Wajam (cataloged across security vendor feeds as Adware:Win32/Wajam, Adware.Wajam, SearchProtect, and Wajam Internet Enhancer) is a notorious adware and browser... |
| goznym | Banking Trojan | 120 | Trojan:Win32/Goznym is a devastating hybrid banking trojan created in early 2016 through the engineering merger of two notorious malware codebases: the Nymaim s... |
| gozi | Banking Trojan | 113 | Trojan:Win32/Gozi (also universally tracked as ISFB and the Ursnif family tree) is one of the most historically significant, resilient banking trojans in comput... |
| guildma | Banking Trojan | 109 | Guildma (also tracked by cybersecurity researchers as Astaroth, Trojan:Win32/Guildma, and Trojan-Banker.Win32.Guildma) is a highly sophisticated, multi-stage mo... |
| palevo | Botnet | 106 | Worm:Win32/Palevo (universally known in cybersecurity research as the Butterfly Bot and the Mariposa botnet) was a monumental, highly modular crimeware botnet t... |
| bancteian | Downloader | 91 | Bancteian (cataloged across security vendors under signatures including Trojan:Win32/Bancteian, TrojanDownloader:Win32/Bancteian, and Trojan.Bancteian) is a spe... |
| dorkbot | Botnet | 86 | Dorkbot (also tracked across intelligence communities as NgrBot and Worm:Win32/Dorkbot) is a notorious multi-vector worm and modular botnet family that infected... |
| bayrob | Trojan | 74 | Bayrob (cataloged across cybersecurity research and international law enforcement filings as Trojan.Bayrob, Win32/Bayrob, and W32.Bayrob) was a notorious cyberc... |
| neurevt | Trojan | 68 | Neurevt (widely recognized across the cybersecurity intelligence ecosystem under the alias Beta Bot, as well as signatures including Trojan:Win32/Neurevt, Troja... |
| carberp | Banking Trojan | 61 | Carberp is an elite, highly sophisticated banking trojan and modular cyber espionage framework first identified in 2010. Developed by a well-organized Russian-U... |
| bancos | Banking Trojan | 55 | Bancos (cataloged across security vendors and threat intelligence databases under signatures including Trojan-Banker.Win32.Bancos, Trojan:Win32/Bancos, and Win3... |
| banbra | Banking Trojan | 53 | Banbra (cataloged across security vendors and threat intelligence databases under signatures including Trojan-Banker.Win32.Banbra, Trojan:Win32/Banbra, and Win3... |
| vawtrak | Banking Trojan | 50 | Vawtrak (widely cataloged across international law enforcement and intelligence communities as Neverquest or Snifula) is one of the most damaging banking trojan... |
| shiotob | Banking Trojan | 47 | Shiotob (extensively documented in threat intelligence literature under the names URLZone and Bebloh, with AV detections including Trojan:Win32/Shiotob and Troj... |
| mekotio | Banking Trojan | 44 | Mekotio (cataloged across security vendors and threat intelligence databases under signatures including Trojan-Banker:Win32/Mekotio, Trojan.Win32.Mekotio, and M... |
| shylock | Banking Trojan | 21 | Shylock (also cataloged across international law enforcement and intelligence communities as Capito) is a sophisticated financial malware family and banking tro... |
| papras | Infostealer | 15 | Papras (classified across cybersecurity vendors as Trojan:Win32/Papras, PWS:Win32/Papras, and Trojan-PSW.Win32.Papras) is a modular password stealer and banking... |
| chthonic | Banking Trojan | 14 | Trojan:Win32/Chthonic is an advanced, highly modular banking trojan and direct evolutionary offshoot of the Zeus (Zbot) codebase discovered by Kaspersky Lab res... |
| retefe | Trojan | 13 | Retefe (historically documented as Trojan:Win32/Retefe and Trojan-Banker.Win32.Retefe) is a sophisticated banking trojan that actively targeted banking institut... |
| sinowal | Banking Trojan | 13 | Trojan:Win32/Sinowal (widely documented in cybersecurity research as Torpig and its underlying MBR rootkit Mebroot) is a historic, landmark financial crimeware ... |
| webcompanion | Advanced Threat | 13 | Adware:Win32/Webcompanion (Lavasoft Web Companion) is a highly controversial application often classified by EDR and Antivirus vendors as a Potentially Unwanted... |
| gamevance | Trojan | 11 | Adware:Win32/Gamevance is a historic, highly aggressive adware framework and Potentially Unwanted Program (PUA) that peaked in the late 2000s and early 2010s. I... |
| crawler | Advanced Threat | 10 | Adware:Win32/Crawler (often associated with the historical 'Crawler Toolbar') is a Potentially Unwanted Program (PUA) and adware family designed to silently hij... |
| lollipop | Advanced Threat | 10 | Adware:Win32/Lollipop is a highly aggressive adware framework and Potentially Unwanted Program (PUA) that peaked in prevalence during the mid-2010s. It was desi... |
| redyms | Ransomware | 10 | Trojan:Win32/Redyms (also known as the **Redyms Botnet**) is a significant malware family whose primary objective is large-scale, automated click fraud and sear... |
| nspm | Advanced Threat | 9 | PUA:Win32/Nspm is a Potentially Unwanted Program (PUA) and adware family often bundled with free software, torrent clients, or media converters. Its primary fun... |
| primecasino | Advanced Threat | 9 | Adware:Win32/Primecasino is a highly aggressive adware framework and Potentially Unwanted Program (PUA) specifically designed to inundate the infected endpoint ... |
| shandaadd | Advanced Threat | 9 | Adware:Win32/Shandaadd is a persistent adware framework and Potentially Unwanted Program (PUA) designed to silently hijack web browsers, inject intrusive advert... |
| slingup | Advanced Threat | 9 | Adware:Win32/Slingup is a persistent Potentially Unwanted Program (PUA) and adware family often bundled with free software. Its primary function is to silently ... |
| adspy | Infostealer | 8 | Adspy (classified in antivirus detection telemetry under designations including PWS:Win32/Adspy, PWS.Win32.Adspy, and Win32/Adspy) is a dedicated information th... |
| cycbot | Ransomware | 8 | Backdoor:Win32/Cycbot is a notorious, highly persistent botnet agent and backdoor primarily known for executing massive click-fraud campaigns and hijacking sear... |
| heye | Advanced Threat | 8 | Adware:Win32/Heye is a persistent Potentially Unwanted Program (PUA) and adware family often bundled with free software. Its primary function is to silently ins... |
| surveyer | Advanced Threat | 8 | Adware:Win32/Surveyer is a persistent Potentially Unwanted Program (PUA) and adware family often bundled with free software. Its primary function is to silently... |
| ytdownloader | Advanced Threat | 8 | PUA:Win32/Ytdownloader (or generic **YouTube Downloader** heuristics) represents a vast category of Potentially Unwanted Programs (PUAs) marketed as tools to sa... |
| adkor | Trojan | 7 | Adkor (classified in antivirus detection telemetry under designations including Trojan:Win32/Adkor, Trojan.Win32.Adkor, and Win32/Adkor) is a multi-stage trojan... |
| axespec | Trojan | 7 | Axespec (classified in antivirus detection telemetry under designations including Trojan:Win32/Axespec, Trojan.Win32.Axespec, and Win32/Axespec) is a multi-stag... |
| chatzum | Advanced Threat | 7 | Adware:Win32/Chatzum is an aggressive Potentially Unwanted Program (PUA) and adware family, functioning primarily as a **Browser Hijacker**. Its core objective ... |
| corebot | Trojan | 7 | Trojan:Win32/Corebot is a highly sophisticated, modular **Banking Trojan** and **Infostealer**. Originally discovered in 2015 acting as a generic credential ste... |
| komodia | Advanced Threat | 7 | Rootkit:Win32/Komodia is a highly controversial software development kit (SDK) designed for network interception and SSL/TLS decryption. Komodia is most infamou... |
| magala | Trojan | 7 | Trojan:Win32/Magala (also known as a **Clicker Trojan**) is a form of malware specifically designed to generate illicit revenue for its operators through automa... |
| mediamagnet | Advanced Threat | 7 | Adware:Win32/Mediamagnet is an aggressive Potentially Unwanted Program (PUA) and adware family often bundled with free software. Its primary function is to sile... |
| miuref | Click Fraud | 7 | Trojan:Win32/Miuref (also known in the cybersecurity community as **Boaxxe**) is a massive, highly resilient botnet primarily focused on generating illicit reve... |
| porntool | Ransomware | 7 | Riskware:Win32/Porntool represents a generic classification for a variety of Potentially Unwanted Programs (PUAs), dialers, and adware specifically bundled with... |
| shopbot | Advanced Threat | 7 | Adware:Win32/Shopbot is an aggressive Potentially Unwanted Program (PUA) and adware family often bundled with free software. Its primary function is to silently... |
| simplified | Advanced Threat | 7 | Adware:Win32/Simplified is an aggressive Potentially Unwanted Program (PUA) and adware family often bundled with free software. Its primary function is to silen... |
| smal | Advanced Threat | 7 | Adware:Win32/Smal is an aggressive Potentially Unwanted Program (PUA) and adware family often bundled with free software. Its primary function is to silently in... |
| speedbit | Advanced Threat | 7 | PUA:Win32/Speedbit (also known as **SpeedBit Video Accelerator** or **Download Accelerator Plus**) represents a category of Potentially Unwanted Programs (PUAs)... |
| stufffull | Advanced Threat | 7 | Adware:Win32/Stufffull is an aggressive Potentially Unwanted Program (PUA) and adware family often bundled with free software. Its primary function is to silent... |
| visicom | Advanced Threat | 7 | Adware:Win32/Visicom is an aggressive Potentially Unwanted Program (PUA) and adware family, functioning primarily as a **Browser Hijacker**. Its core objective ... |
| freenew | Advanced Threat | 6 | Adware:Win32/Freenew is an aggressive Potentially Unwanted Program (PUA) and adware family often bundled with free software. Its primary function is to silently... |
| nivdort | Trojan | 6 | <h3>Executive Summary</h3> Nivdort (also widely tracked as Bayrob) is a highly sophisticated, modular Trojan and botnet client. Initially discovered around 2007... |
| softobase | Advanced Threat | 6 | Adware:Win32/Softobase is an aggressive Potentially Unwanted Program (PUA) and adware family often bundled with free software. Its primary function is to silent... |
| toptools | Advanced Threat | 6 | Adware:Win32/Toptools is an aggressive Potentially Unwanted Program (PUA) and adware family often bundled with free software. Its primary function is to silentl... |
| torntv | Advanced Threat | 6 | Adware:Win32/Torntv is an aggressive Potentially Unwanted Program (PUA) and adware family, functioning primarily as a **Browser Hijacker** and rogue toolbar. It... |
| amavaldo | Trojan | 5 | Amavaldo (classified in antivirus detection telemetry under designations including Trojan:Win32/Amavaldo, Trojan.Win32.Amavaldo, and Win32/Amavaldo) is a multi-... |
| qadars | Trojan | 5 | Trojan:Win32/Qadars is a highly sophisticated, commercially sold banking trojan and botnet framework. Its primary objective is to facilitate severe financial fr... |
| tinukebot | Trojan | 5 | Trojan:Win32/Tinukebot (widely known as **TinyNuke** or Nuclear Bot) is a sophisticated, commercially sold banking trojan and botnet framework. Its primary obje... |
| bzub | Trojan | 4 | Bzub (classified in antivirus detection telemetry under designations including Trojan:Win32/Bzub, Trojan.Win32.Bzub, and Win32/Bzub) is a multi-stage trojan eng... |
| hvnc | Trojan | 4 | Backdoor:Win32/hVNC (Hidden Virtual Network Computing) represents a devastatingly stealthy class of Remote Access Trojans (RATs). While standard VNC is a legiti... |
| pwszbot | Trojan | 4 | Trojan:Win32/Pwszbot (a blend of Password Stealer and Zbot/Zeus functionalities) is a highly sophisticated, modular banking trojan and information stealer. It i... |
| bebloh | Trojan | 3 | Bebloh (classified in antivirus detection telemetry under designations including Trojan:Win32/Bebloh, Trojan.Win32.Bebloh, and Win32/Bebloh) is a multi-stage tr... |
| betabot | Trojan | 3 | Betabot (classified in antivirus detection telemetry under designations including Trojan:Win32/Betabot, Trojan.Win32.Betabot, and Win32/Betabot) is a multi-stag... |
| backswap | Trojan | 2 | Backswap (classified in antivirus detection telemetry under designations including Trojan:Win32/Backswap, Trojan.Win32.Backswap, and Win32/Backswap) is a multi-... |
| ezula | Advanced Threat | 2 | Adware:Win32/Ezula is a historically significant and highly aggressive Potentially Unwanted Program (PUP) categorized as a Browser Hijacker. Active primarily in... |
| napolar | Trojan | 2 | Trojan:Win32/Napolar (also widely tracked as Solarbot) is a highly sophisticated banking trojan and botnet client that gained prominence around 2013. It is desi... |
| redirected | Trojan | 2 | Behavior:Win32/Redirected is a severe **Heuristic Detection** that flags unauthorized changes to the system's network configuration aimed at intercepting, monit... |
| sphinx | Trojan | 2 | Trojan:Win32/Sphinx is a sophisticated Info-Stealer and banking trojan, highly active in targeting financial institutions and cryptocurrency platforms. While it... |
| adbreak | Ransomware | 1 | Adbreak (classified in antivirus detection telemetry under designations including Ransom:Win32/Adbreak, Ransom.Win32.Adbreak, and Win32/Adbreak) is a crypto-ran... |
| adpernok | Ransomware | 1 | Adpernok (classified in antivirus detection telemetry under designations including Ransom:Win32/Adpernok, Ransom.Win32.Adpernok, and Win32/Adpernok) is a crypto... |
| adpower | Ransomware | 1 | Adpower (classified in antivirus detection telemetry under designations including Ransom:Win32/Adpower, Ransom.Win32.Adpower, and Win32/Adpower) is a crypto-ran... |
| adwaresig | Adware | 1 | Adwaresig (classified in antivirus detection telemetry under designations including Adware:Win32/Adwaresig, Adware.Win32.Adwaresig, and Win32/Adwaresig) is a co... |
| awangba | Ransomware | 1 | Awangba (classified in antivirus detection telemetry under designations including Ransom:Win32/Awangba, Ransom.Win32.Awangba, and Win32/Awangba) is a crypto-ran... |
| baiduwrapper | Ransomware | 1 | Baiduwrapper (classified in antivirus detection telemetry under designations including Ransom:Win32/Baiduwrapper, Ransom.Win32.Baiduwrapper, and Win32/Baiduwrap... |
| bancobras | Trojan | 1 | Bancobras (classified in antivirus detection telemetry under designations including Trojan:Win32/Bancobras, Trojan.Win32.Bancobras, and Win32/Bancobras) is a mu... |
| bankoren | Trojan | 1 | Bankoren (classified in antivirus detection telemetry under designations including Trojan:Win32/Bankoren, Trojan.Win32.Bankoren, and Win32/Bankoren) is a multi-... |
| banks | Trojan | 1 | Banks (classified in antivirus detection telemetry under designations including Trojan:Win32/Banks, Trojan.Win32.Banks, and Win32/Banks) is a multi-stage trojan... |
| bettersurf | Adware | 1 | Bettersurf (classified in antivirus detection telemetry under designations including Adware:Win32/Bettersurf, Adware.Win32.Bettersurf, and Win32/Bettersurf) is ... |
| bhoint | Trojan | 1 | Bhoint (classified in antivirus detection telemetry under designations including Trojan:Win32/Bhoint, Trojan.Win32.Bhoint, and Win32/Bhoint) is a multi-stage tr... |
| bnksa | Trojan | 1 | Bnksa (classified in antivirus detection telemetry under designations including Trojan:Win32/Bnksa, Trojan.Win32.Bnksa, and Win32/Bnksa) is a multi-stage trojan... |
| bolik | Trojan | 1 | Bolik (classified in antivirus detection telemetry under designations including Trojan:Win32/Bolik, Trojan.Win32.Bolik, and Win32/Bolik) is a multi-stage trojan... |
| boxter | Ransomware | 1 | Boxter (classified in antivirus detection telemetry under designations including Ransom:Win32/Boxter, Ransom.Win32.Boxter, and Win32/Boxter) is a crypto-ransomw... |
| boychi | Ransomware | 1 | Boychi (classified in antivirus detection telemetry under designations including Ransom:Win32/Boychi, Ransom.Win32.Boychi, and Win32/Boychi) is a crypto-ransomw... |
| bplug | Ransomware | 1 | Bplug (classified in antivirus detection telemetry under designations including Ransom:Win32/Bplug, Ransom.Win32.Bplug, and Win32/Bplug) is a crypto-ransomware ... |
| cashfiesta | Trojan | 1 | Cashfiesta (classified in antivirus detection telemetry under designations including Trojan:Win32/Cashfiesta, Trojan.Win32.Cashfiesta, and Win32/Cashfiesta) is ... |
| clearsearch | Ransomware | 1 | <h3>Executive Summary</h3> ClearSearch is a highly disruptive Adware and Browser Hijacker variant designed to aggressively monetize infected endpoints. It achie... |
| cnnic | Ransomware | 1 | <h3>Executive Summary</h3> CNNIC (often associated with the China Internet Network Information Center) in a cybersecurity context typically refers to a classifi... |
| couponmarvel | Ransomware | 1 | <h3>Executive Summary</h3> CouponMarvel is an aggressive Adware application and Potentially Unwanted Program (PUP) primarily targeting Windows operating systems... |
| cridex | Trojan | 1 | <h3>Executive Summary</h3> Cridex is a highly influential banking trojan and worm that emerged in 2011, notorious for being the direct predecessor to the devast... |
| emarketing | Ransomware | 1 | <h3>Executive Summary</h3> Emarketing is a classification for a broad category of Adware and Spyware programs designed for aggressive, unauthorized monetization... |
| exent | Ransomware | 1 | <h3>Executive Summary</h3> Exent is a classification often associated with aggressive Potentially Unwanted Programs (PUPs) and Adware that masquerade as gaming ... |
| ezsoftwareupdater | Ransomware | 1 | <h3>Executive Summary</h3> EZSoftwareUpdater is an aggressive Potentially Unwanted Program (PUP) and Adware application that masquerades as a legitimate system ... |
| fakeff | Trojan | 1 | <h3>Executive Summary</h3> FakeFF is a specific classification for deceptive malware or Adware that masquerades as a legitimate component of the Mozilla Firefox... |
| favadd | Trojan | 1 | <h3>Executive Summary</h3> Favadd (often detected as Adware.Favadd or Trojan.Favadd) is a class of Adware and Potentially Unwanted Programs (PUP) prevalent duri... |
| firehooker | Trojan | 1 | <h3>Executive Summary</h3> Firehooker is a highly specialized Information Stealer (Info-Stealer) designed specifically to target web browsers, with a historical... |
| flowspirit | Ransomware | 1 | <h3>Executive Summary</h3> FlowSpirit is an aggressive Adware and Potentially Unwanted Program (PUP) designed to heavily monetize infected systems. It achieves ... |
| flvdirect | Ransomware | 1 | <h3>Executive Summary</h3> FLVDirect is a classification for a category of Adware and Potentially Unwanted Programs (PUPs). Its primary objective is unauthorize... |
| gemius | Advanced Threat | 1 | <h3>Executive Summary</h3> Gemius is a prominent web analytics and audience measurement technology. While technically a legitimate commercial service used by we... |
| genericrxad | Ransomware | 1 | <h3>Executive Summary</h3> "Genericrxad" (often displayed as Generic.RX.Adware) is a heuristic detection name utilized by various antivirus engines to flag file... |
| hpursnif | Trojan | 1 | <h3>Executive Summary</h3> Hpursnif is a highly dangerous and sophisticated alias/variant of the infamous **Ursnif** (also known as Gozi or ISFB) Banking Trojan... |
| iezones | Trojan | 1 | <h3>Executive Summary</h3> IEZones (Internet Explorer Zones) represents a class of Adware and Spyware that specifically targets the security zone configurations... |
| installbar | Ransomware | 1 | <h3>Executive Summary</h3> InstallBar is an aggressive Potentially Unwanted Program (PUP) and Adware application that operates primarily as a Browser Hijacker. ... |
| look2me | Trojan | 1 | <h3>Executive Summary</h3> Look2Me (also known as L2M) is a notoriously aggressive and persistent form of Adware and Spyware that plagued Windows systems heavil... |
| medialabs | Ransomware | 1 | <h3>Executive Summary</h3> Medialabs is a classification for a broad category of Adware and Potentially Unwanted Programs (PUPs). Its primary objective is unaut... |
| mediana | Advanced Threat | 1 | <h3>Executive Summary</h3> Mediana is an aggressive Potentially Unwanted Program (PUP) and Adware application that masquerades as a legitimate browser enhanceme... |
| meikehuayi | Ransomware | 1 | <h3>Executive Summary</h3> Meikehuayi is an aggressive Potentially Unwanted Program (PUP) and Adware application, frequently originating from Chinese software d... |
| mostofate | Ransomware | 1 | <h3>Executive Summary</h3> Mostofate is an aggressive Potentially Unwanted Program (PUP) and Adware application that operates primarily as a Browser Hijacker. I... |
| multibanker | Trojan | 1 | Trojan:Win32/Multibanker represents a sophisticated class of financial malware designed to target multiple banking institutions simultaneously. Unlike older, si... |
| mutabaha | Advanced Threat | 1 | <h3>Executive Summary</h3> Mutabaha is an aggressive Potentially Unwanted Program (PUP) and Adware application that masquerades as a legitimate system utility, ... |
| mydisksu | Ransomware | 1 | <h3>Executive Summary</h3> Mydisksu is an intrusive Adware application and Potentially Unwanted Program (PUP) primarily targeting Windows operating systems. It ... |
| mytonel | Ransomware | 1 | <h3>Executive Summary</h3> Mytonel is a classification for a category of Adware and Potentially Unwanted Programs (PUPs). Its primary objective is unauthorized ... |
| nhopro | Advanced Threat | 1 | <h3>Executive Summary</h3> Nhopro is an aggressive Potentially Unwanted Program (PUP) and Adware application that masquerades as a legitimate system utility, op... |
| nottotrack | Advanced Threat | 1 | <h3>Executive Summary</h3> NotToTrack is an ironically named Adware and Spyware application. While its name implies privacy protection or anti-tracking capabili... |
| offerbox | Ransomware | 1 | <h3>Executive Summary</h3> Offerbox (often detected as Adware.OfferBox or PUP.OfferBox) is a highly intrusive Adware application and Potentially Unwanted Progra... |
| olext | Advanced Threat | 1 | <h3>Executive Summary</h3> Olext is an aggressive Potentially Unwanted Program (PUP) and Adware application, frequently distributed as a deceptive browser exten... |
| pontoeb | Advanced Threat | 1 | <h3>Executive Summary</h3> Pontoeb is an aggressive Potentially Unwanted Program (PUP) and Adware application that masquerades as a legitimate browser enhanceme... |
| redaman | Trojan | 1 | <h3>Executive Summary</h3> Redaman is a highly sophisticated Banking Trojan that primarily targets financial institutions, payment processors, and corporate ban... |
| ridapi | Ransomware | 1 | <h3>Executive Summary</h3> Ridapi is an aggressive Potentially Unwanted Program (PUP) and Adware application that operates primarily as a Browser Hijacker. It m... |
| roboinstall | Advanced Threat | 1 | <h3>Executive Summary</h3> RoboInstall is an aggressive software bundler and Potentially Unwanted Program (PUP) installer. It is designed to maximize affiliate ... |
| ruanmei | Advanced Threat | 1 | <h3>Executive Summary</h3> Ruanmei is an aggressive Potentially Unwanted Program (PUP) and Adware application that masquerades as a legitimate browser enhanceme... |
| sanctionedmedia | Ransomware | 1 | <h3>Executive Summary</h3> SanctionedMedia is a classification for a broad category of Adware and Potentially Unwanted Programs (PUPs). Its primary objective is... |
| searchprovide | Ransomware | 1 | <h3>Executive Summary</h3> SearchProvide is a highly disruptive Adware and Browser Hijacker variant designed to aggressively monetize infected endpoints. It ach... |
| secucharge | Ransomware | 1 | <h3>Executive Summary</h3> SecuCharge is a classification for a category of Adware and Potentially Unwanted Programs (PUPs). Its primary objective is unauthoriz... |
| seznam | Trojan | 1 | <h3>Executive Summary</h3> In a cybersecurity context, "Seznam" detections typically refer to aggressive browser hijackers and Potentially Unwanted Programs (PU... |
| shopperpro | Ransomware | 1 | <h3>Executive Summary</h3> ShopperPro is an aggressive Adware application and Potentially Unwanted Program (PUP) primarily targeting Windows operating systems. ... |
| softcdn | Ransomware | 1 | <h3>Executive Summary</h3> SoftCDN (often detected as PUP.SoftCDN or Adware.SoftCDN) represents a class of deceptive software bundlers and "download managers." ... |
| sokuxuan | Ransomware | 1 | <h3>Executive Summary</h3> Sokuxuan is an aggressive Adware and Potentially Unwanted Program (PUP) designed to monetize infected systems. It achieves this by hi... |
| specialsearchoffer | Ransomware | 1 | <h3>Executive Summary</h3> SpecialSearchOffer is a highly intrusive Adware and Browser Hijacker variant designed to aggressively monetize infected endpoints. It... |
| springtech | Advanced Threat | 1 | <h3>Executive Summary</h3> Springtech is an aggressive Potentially Unwanted Program (PUP) and Adware application that masquerades as a legitimate system utility... |
| streamer | Ransomware | 1 | <h3>Executive Summary</h3> Streamer (often detected as Adware.Streamer or PUP.Streamer) is a Potentially Unwanted Program that typically masquerades as a legiti... |
| taobao | Advanced Threat | 1 | <h3>Executive Summary</h3> In a cybersecurity context, detections named "Taobao" do not refer to the legitimate Alibaba e-commerce platform itself, but rather t... |
| taojinstar | Advanced Threat | 1 | <h3>Executive Summary</h3> Taojinstar is an aggressive Potentially Unwanted Program (PUP) and Adware application that masquerades as a legitimate system utility... |
| viddyhd | Ransomware | 1 | <h3>Executive Summary</h3> ViddyHD is a highly intrusive Adware application and Potentially Unwanted Program (PUP) primarily targeting Windows operating systems... |
| whiteclick | Ransomware | 1 | <h3>Executive Summary</h3> Whiteclick (often detected as Adware.Whiteclick or PUP.Whiteclick) is an intrusive Adware application and "Clicker" malware. It is de... |
| winshow | Ransomware | 1 | <h3>Executive Summary</h3> WinShow is a highly disruptive Adware and Browser Hijacker variant designed to aggressively monetize infected endpoints. It achieves ... |
| yiwanzhushou | Ransomware | 1 | <h3>Executive Summary</h3> Yiwanzhushou is an aggressive Potentially Unwanted Program (PUP) and Adware application that operates primarily as a Browser Hijacker... |
| zacinlo | Advanced Threat | 1 | <h3>Executive Summary</h3> Zacinlo is a highly sophisticated Adware and Rootkit framework. Unlike standard adware that relies on simple browser extensions, Zaci... |
| zeusvm | Banking Trojan | 1 | Trojan-Banker:Win32/ZeusVM (also widely tracked in underground forums as KINS) is a highly sophisticated banking trojan variant derived from the leaked Zeus 2.0... |
| zwangi | Ransomware | 1 | <h3>Executive Summary</h3> Zwangi is a highly persistent Adware and Potentially Unwanted Program (PUP) designed to aggressively monetize infected systems. It ac... |
| aero | Adware | Sampled | Aero (frequently cataloged in security telemetry as AERO Sample or BrowserModifier:Win32/Aero) represents a persistent category of Potentially Unwanted Applicat... |