Blog.

Welcome back to our Triage Thursday™ blog series! We’re excited to share this week’s detection updates with you. In these quick posts, we highlight the latest malware families detections that have been added.

New Windows Families This Week

• Added detection and extraction for SloppyRat, Windows RAT
  • SloppyRat sample:
    • 260923-rkk8zadc23
• Added detection and extraction for SaturnStealer, Windows stealer
  • SaturnStealer sample:
    • 260923-rrttpa1xaz
• Added detection for BTWStealer, Windows stealer
  • BTWStealer sample:
    • 260923-rr1x1aws3l
• Added detection for FearStealer, Windows stealer
  • FearStealer sample:
    • 260923-rkhsvadb96
• Added detection for CapyAgent, Windows agent
  • CapyAgent sample:
    • 260923-rkkbnsdb99
• Added detection for OverDrive Stealer, Windows stealer
  • OverDrive sample:
    • 260923-rkh4ls1wcv
• Added detection for Ligolo, cross-platform hacktool
  • Ligolo samples:
    • Linux: 260923-rkhg3sdb95
    • Windows: 260923-rklvhatfnb

Detection for Android

• Added detection and extraction for MantaxOtax, Android ransomware and spyware
  • MantaxOtax sample:
    • 260923-rsnn3adc94

Detection for Linux and Network Families

• Added detection for AGbot, Mirai-based Linux botnet
  • AGbot sample:
    • 260923-rkkx7s1wcy

Updates for Existing Families

• Updated detection and extractor for XtinyLoader new variant
  • XtinyLoader sample:
    • 260923-rkh4lsdb97
• Updated extractor for another variant of SiriusRat
  • SiriusRat sample:
    • 260923-rkljqsdc25
• Updated extraction for latest PhantomStealer v4.x
  • PhantomStealer sample:
    • 260923-rkkbns1wcx
• Updated extraction for unextracted Metasploit Android version
  • Metasploit sample:
    • 260923-rvg93aws9k
• Updated detection and extraction for Xloader, Android banking trojan
  • Xloader sample:
    • 260914-gyf63ahk4s
• Updated detection for SolarisLoader with more extracted information
  • SolarisLoader sample:
    • 260923-rkk8za1wcz
• Updated detection for plaintext, Motorola, Renesas and ARM variants of Mirai
  • Mirai samples:
    • plaintext variant: 260923-rkk8zatfna
    • Motorola variant: 260923-rkk8zadc24
    • Renesas variant: 260923-rkh4ls1wct
    • ARM variant: 260923-rkkmfadc22

If you have any feedback, questions, or issues about Triage™ feel free to reach out to us any time - we do our best to respond to all feedback but even if we can’t get back to you straight away your files will go into our list of things to review and help us prioritize tasks.

You can find us directly through the website, or using the Feedback option on an analysis report page.

Not signed up yet? Head over to tria.ge to register for a free account.