Blog.

Welcome back to our Triage Thursday™ blog series! We’re excited to share this week’s detection updates with you. In these quick posts, we highlight the latest malware families detections that have been added.

New Windows Families This Week

• Added detection and extraction for GalaxyRAT, Windows RAT
  • GalaxyRAT sample:
    • 260728-hxz38adm2x
• Added detection and extraction for SolarisLoader, Windows loader
  • SolarisLoader sample:
    • 260727-vmj1gaxdne
• Added detection for DemonStealer, Windows stealer
  • DemonStealer sample:
    • 260728-hyyxjsdm3x
• Added detection for MSDuckStealer, Windows stealer
  • MSDuckStealer sample:
    • 260728-hyxpgs1ckg
• Added detection for CybrexAgent, Windows agent
  • CybrexAgent sample:
    • 260728-h2yqys1ygw
• Added detection for MedusaStealer aka MedusaBot, Windows stealer
  • MedusaStealer sample:
    • 260728-hyzh3s1cld
• Added detection for GigaWiper malware, Windows wiper
  • GigaWiper (Windows wiper) sample:
    • 260728-hywr7a1yaz
• Added detection for SecureByte crypter
  • sample: 260728-hyxdqa1ckf

Detection for Android

• Added detection and extraction for Octagon, Android RAT
  • Octagon sample:
    • 260728-hy1fda1ybw
• Added detection for GoldenRAT, Android RAT
  • GoldenRAT sample:
    • 260728-hyylsadm3w

Detection for Linux and Network Families

• Added detection for RudeDEvil Botnet, Linux botnet
  • RudeDevil sample:
    • 260728-h32t1a1dlh
• Added detection for PinkBot, Linux Botnet
  • PinkBot sample:
    • 260728-hywges1cke
• Added detection for AcidRain, Linux wiper
  • AcidRain sample:
    • 260728-hy1q5s1ybx
• Added detection for AcidPour, Linux wiper
  • AcidPour sample:
    • 260728-hyya1s1cla
• Added detection for BOLDMOVE, Linux RAT
  • BOLDMOVE sample:
    • 260728-hyv6na1yay
• Added detection for Evilginx, phishing/MitM framework
  • sample: 260728-hyyxjs1clb

Detection for APT Groups

• Added detection for TSCookie Backdoor (two variants), APT BlackTech
  • TSCookie samples:
    • 260728-hyxz9adm3v
    • 260728-hy2cnsdm4s

Detection for Ransomware

• RAHIDLOCKER sample:
  • 260728-hyy8ba1clc
• RedStar sample:
  • 260728-hy12xa1clf
• GalaxyRansomware sample:
  • 260728-hy12xa1yby
• MaxLocker sample:
  • 260728-h58qbs1dqg

Updates for Existing Families

• Updated detection and extractor for Vidar v2.4 to v2.5
  • Vidar samples:
    • 260728-hyya1s1ybv
    • 260728-h8bvrs1zfv

If you have any feedback, questions, or issues about Triage™ feel free to reach out to us any time - we do our best to respond to all feedback but even if we can’t get back to you straight away your files will go into our list of things to review and help us prioritize tasks.

You can find us directly through the website, or using the Feedback option on an analysis report page.

Not signed up yet? Head over to tria.ge to register for a free account.