Blog.

Welcome back to our Triage Thursday™ blog series! We’re excited to share this week’s detection updates with you. In these quick posts, we highlight the latest malware families detections that have been added.

New Windows Families This Week

• Added detection and extraction for PhantomLoader, DGA loader
  • PhantomLoader sample:
    • 260826-syvj8s1fqh
• Added detection for SnakeBiteStealer, Windows stealer
  • SnakeBiteStealer sample:
    • 260826-syx1cs1frf
• Added detection and extraction for MasonRAT, Windows RAT
  • MasonRAT sample:
    • 260826-syyxnafm9z
• Added detection and extraction for EvolutionRAT, Windows RAT
  • EvolutionRAT sample:
    • 260826-sy121sea77
• Added detection and extractor for MiniFast, Windows loader
  • MiniFast sample:
    • 260826-syrhks1fpg
• Added detection for StowProxy hacktool
  • sample: 260826-syya5afm9x

Detection for macOS

• Added detection for MacOS variant of OverlordRAT
  • OverlordRAT sample:
    • 260826-s1qdasfn4x
• Added detection for MacHug, macOS malware
  • MacHug sample:
    • 260826-s1y1fafn5v

Detection for Android

• Added detection and extraction for ProSpy, Android spyware
  • ProSpy sample:
    • 260826-syvv1a1frc
• Added detection for Keenadu, Android botnet
  • Keenadu sample:
    • 260826-sysqms1fqc

Updates for Existing Families

• Update detection and extraction for CobaltStrike different packed variants
  • CobaltStrike samples:
    • x64: 260826-syqw2syyet
    • .NET packed beacon: 260826-syxpla1fre
    • RC4-encrypted beacon: 260826-syw33a1frd
    • Unextracted CobaltStrike64: 260826-sy121sfn2t
• Updated detection and fallback for StealC v2.6 (update 3), x64 and x86 variants
  • StealC samples:
    • x64: 260826-syw33afm9t
    • x86: 260826-syn3fsyydx
• Updated detection and extractor for Vidar v2.9
  • Vidar sample:
    • 260826-sywgjafm81
• Updated extractor for BlakcSeeStealer to allow non-IPv4 C2s
  • BlakcSeeStealer sample:
    • 260826-syyxnaea76

If you have any feedback, questions, or issues about Triage™ feel free to reach out to us any time - we do our best to respond to all feedback but even if we can’t get back to you straight away your files will go into our list of things to review and help us prioritize tasks.

You can find us directly through the website, or using the Feedback option on an analysis report page.

Not signed up yet? Head over to tria.ge to register for a free account.