Blog.

Welcome back to our Triage Thursday™ blog series! We’re excited to share this week’s detection updates with you. In these quick posts, we highlight the latest malware families detections that have been added.

New Windows Families This Week

• Added detection and extraction for CobraRAT, Windows RAT
  • CobraRAT sample:
    • 260923-nhndrsae36
• Added detection and extraction for ZyxStealer, Windows stealer
  • ZyxStealer sample:
    • 260923-nhs91ssemc
• Added detection and extraction for JumpscareRAT, Windows RAT
  • JumpscareRAT sample:
    • 260923-nes5vasdqc
• Added detection and extraction for BridgeAgent, Windows RAT
  • BridgeAgent sample:
    • 260918-etz29swdlf
• Added detection for LabubaRAT, Windows RAT
  • LabubaRAT sample:
    • 260923-nhefvsselg
• Added detection for Ramsay, Windows spyware framework
  • Ramsay sample:
    • 260913-dw8lraee26
• Added detection for Bancos Banker, Windows LATAM banking trojan
  • Bancos sample:
    • 260923-nevzfasdrd

Detection for Android

• Added detection for IRRat, Android RAT
  • IRRat sample:
    • 260923-nh3hpasena
• Added detection for CECbot, Android botnet
  • CECbot sample:
    • 260923-nevnnssdrb
• Added detection and extraction for Manic, Android banking trojan
  • Manic sample:
    • 260923-njccwssepa

Detection for Cross-Platform Families

• Added detection for LightSpy, cross-platform modular spyware framework (Android / iOS / Windows / macOS)
  • LightSpy samples:
    • macOS loader: 260923-nerxsasdqa
    • macOS stealer: 260923-nera9a1t5j
    • iOS stealer: 260923-nerl1ssdph
    • Windows Outlook plugin: 260923-nevcxasdra

Detection for APT Groups

• Added detection and extractor for MiniJunk, APT Nimbus Manticore
  • MiniJunk sample:
    • 260923-net25ssdqe

Updates for Existing Families

• Added detection for Octo2’s DGA ELF payload
  • Octo2 sample:
    • 260818-3edgqat1ew
• Updated detection for VoltStealer
  • VoltStealer sample:
    • 260923-nk371a1v4m

If you have any feedback, questions, or issues about Triage™ feel free to reach out to us any time - we do our best to respond to all feedback but even if we can’t get back to you straight away your files will go into our list of things to review and help us prioritize tasks.

You can find us directly through the website, or using the Feedback option on an analysis report page.

Not signed up yet? Head over to tria.ge to register for a free account.