Welcome back to our Triage Thursday™ blog series! We’re excited to share this week’s detection updates with you. In these quick posts, we highlight the latest malware families detections that have been added.
New Windows Families This Week
- Added detection and extraction for GoSteal, Windows stealer
- GoSteal sample:
- Added detection for LuvswagStealer, Windows stealer
- LuvswagStealer sample:
- Added detection for BrunoStealer, Windows stealer
- BrunoStealer sample:
- Added detection for Nemesis, Windows stealer
- Nemesis sample:
- Added detection for AnimateClipper, Windows clipper
- AnimateClipper sample:
- Added detection for PasivRobber, Windows stealer
- PasivRobber sample:
- Added detection for IRCbot, Windows backdoor
- IRCbot sample:
- Added detection for RodexRMM, RMM tool abused as backdoor
- sample: 260706-pmkdcae17y
- Added detection for KerBrute, Kerberos brute-force hacktool
- sample: 260706-pmlleaaz9q
Detection for Android
- Added detection and extraction for Rokarolla, Android banking trojan
- Rokarolla sample:
- Added detection for FakeGram, Android spyware
- FakeGram sample:
- Added detection for FastFire, Android spyware
- FastFire sample:
- Added detection for FastSpy, Android spyware
- FastSpy sample:
- Added detection for FinFisher, Android spyware
- FinFisher sample:
- Added detection for Rana, Android spyware
- Rana sample:
- Added detection for MazarBot, Android banking trojan
- MazarBot sample:
Detection for Linux Families
- Added detection for Mettle, Linux backdoor (Metasploit payload)
- Mettle sample:
- Added detection for sysrv-Hello, Linux crypto worm bot
- sysrv-Hello sample:
- Added detection for HelloBot, Linux botnet (APT Earth Berberoka aka GamblingPuppet)
- HelloBot sample:
- Added detection for AVrecon, Linux RAT
- AVrecon sample:
- Added detection for SprySOCKS, Linux backdoor
- SprySOCKS sample:
- Added detection for Gokcpdoor, Linux backdoor
- Gokcpdoor sample:
- Added detection for Elevator, Linux rootkit
- Elevator sample:
- Added detection for TripleCross, Linux eBPF rootkit
- TripleCross sample:
- Added detection for GoTitan, Linux botnet
- GoTitan sample:
- Added detection for KrasueRAT, Linux RAT
- KrasueRAT sample:
- Added detection for cms8000, Linux backdoor
- cms8000 sample:
- Added detection for Kubo Injector, Linux library-injector hacktool
- sample: 260706-pmne1aa12m
Detection for APT Groups
- Added detection for Gomir backdoor, APT Kimsuky
- Gomir sample:
- Added detection for sshdinjector backdoor, APT evasive_panda
- sshdinjector sample:
- Added detection for SecondDate backdoor, APT Equation Group
- SecondDate sample:
- Added detection for Karkoff, Windows backdoor (APT34)
- Karkoff sample:
Detection for Ransomware
- DiskHelpYou (Linux ransomware) sample:
- GonnaCry (Linux ransomware) sample:
- IPRoyal (Linux ransomware) sample:
- Freya sample:
- IsraBye sample:
- ItsSoEasy (cross-platform Windows/Linux) sample:
- JelagggSolution sample:
- JokerRansom sample:
- Khonsari sample:
- Lambda sample:
- Lorenz sample:
- MilkmanVictory sample:
- MzRevenge sample:
- NoCry sample:
- Nokoyawa sample:
- Nopyfy sample:
- RagnarLocker (ELF variant, Linux ransomware) sample:
- Monti (ELF variant, Linux ransomware) sample:
- Gwisin (Linux ransomware) sample:
Updates for Existing Families
- Updated detection for Vidar v2.1 and higher
- Updated detection for NominatusCrypto, added DOS variant
- NominatusCrypto sample:
If you have any feedback, questions, or issues about Triage™ feel free to reach out to us any time - we do our best to respond to all feedback but even if we can’t get back to you straight away your files will go into our list of things to review and help us prioritize tasks.
You can find us directly through the website, or using the Feedback option on an analysis report page.
Not signed up yet? Head over to tria.ge to register for a free account.