Blog.

Welcome back to our Triage Thursday™ blog series! We’re excited to share this week’s detection updates with you. In these quick posts, we highlight the latest malware families detections that have been added.

New Windows Families This Week

• Added detection and extraction for TeleShim, Windows backdoor
  • TeleShim sample:
    • 260910-len5saan3x
• Added detection and extraction for HypeAgent, Windows RAT
  • HypeAgent sample:
    • 260910-lem8gs1dma
• Added detection and extraction for Benet, Windows loader
  • Benet sample:
    • 260910-lerwns1dna
• Added detection and extraction for PackClient, Windows loader
  • PackClient sample:
    • 260910-leqcva1dmf
• Added detection and extraction for MegaRat, Windows RAT
  • MegaRat sample:
    • 260910-lepfjsan3y
• Added detection and extraction for Aokigahara, Windows stealer
  • Aokigahara sample:
    • 260910-lemxqa1dlh
• Added detection and extraction for KurionStealer, Windows stealer
  • KurionStealer sample:
    • 260910-les4qsan4z
• Added detection and extraction for XenRAT, Windows RAT
  • XenRAT sample:
    • 260910-lesg7stzbs
• Added detection and extraction for WebRAT, Windows RAT
  • WebRAT sample:
    • 260910-lep23san3z
• Added detection and extraction for ArvionRAT, Windows RAT
  • ArvionRAT sample:
    • 260910-lesg7san4x
• Added detection for RUSTRUST, Windows stealer
  • RUSTRUST sample:
    • 260910-lep23san4s
• Added detection for CNBackdoor, Windows backdoor
  • CNBackdoor sample:
    • 260910-lml1dst1bx
• Added detection for ClickLock Stealer, Linux stealer delivered via ClickFix
  • ClickLock sample:
    • 260910-lesszaan4y
• Added detection for RootRun hacktool
  • sample: 260910-leqnlsan4t

Detection for Linux Families

• Added detection and extraction for RedShell, Linux backdoor
  • RedShell sample:
    • 260910-len5sa1dmd

Detection for Android

• Added detection and extraction for Octo2, Android banking trojan
  • Octo2 sample:
    • 260910-lerkxa1dmh

Detection for APT Groups

• Added detection for SheetAgent, APT36
  • SheetAgent samples:
    • 260910-ler7faan4w
• Added detection for CrystalShell, APT36
  • CrystalShell sample:
    • 260910-lent1s1dmb
• Added detection for BackupSpy, APT36
  • BackupSpy sample:
    • 260910-lesszatzbt

Updates for Existing Families

• Updated detection for MailCreep
  • MailCreep sample:
    • 260910-leqnls1dmg

If you have any feedback, questions, or issues about Triage™ feel free to reach out to us any time - we do our best to respond to all feedback but even if we can’t get back to you straight away your files will go into our list of things to review and help us prioritize tasks.

You can find us directly through the website, or using the Feedback option on an analysis report page.

Not signed up yet? Head over to tria.ge to register for a free account.