Blog.

Welcome back to our Triage Thursday™ blog series! We’re excited to share this week’s detection updates with you. In these quick posts, we highlight the latest malware families detections that have been added.

New Windows Families This Week

• Added detection and extractor for AzaleaRat, Windows RAT
  • AzaleaRat sample:
    • 260925-ssb6psyhkd
• Added detection and extraction for DolphinX, Windows malware
  • DolphinX sample:
    • 260928-h7cqnsyapb
• Added detection and extraction for AestheticStealer, Windows stealer
  • AestheticStealer sample:
    • 260928-hfh4daywf1
• Added detection and extraction for VectraRAT, Windows RAT
  • VectraRAT sample:
    • 260928-h7sf5ayaqb
• Added detection for VorkutaStealer, Windows stealer
  • VorkutaStealer sample:
    • 260928-h6pzlsys6r
• Added detection for NylonX, Windows malware
  • NylonX sample:
    • 260928-h63kpszsdv
• Added detection for ZionSiphon, Windows stealer
  • ZionSiphon sample:
    • 260925-sn2wka1w5q

Detection for Android

• Added detection for TalentRAT, Android RAT
  • TalentRAT sample:
    • 260925-sn41xsyfrh
• Added detection for StealthAgent, Android spyware
  • StealthAgent sample:
    • 260926-l8tbla1dja

Detection for Linux and Network Families

• Added detection for MilanBot, Linux botnet
  • MilanBot sample:
    • 260925-sn3svsyfre
• Added detection for FlyLegitBot, Linux botnet
  • FlyLegitBot sample:
    • 260927-nt5r7awhph
• Added detection for Okami, Linux botnet
  • Okami sample:
    • 260925-sn5mfsvvex

Detection for Cross-Platform Families

• Added detection and extractor for VoidShadow, cross-platform post-exploitation framework
  • VoidShadow samples:
    • PE: 260928-h8qnxsyt2r
    • ELF: 260928-h8zltsyt4j

Detection for APT Groups

• Added detection for SparrowWockey backdoor and loader, APT FamousSparrow
  • SparrowWockey samples:
    • backdoor: 260925-sn5x8avvey
    • loader: 260925-sn3g4avvdz

Updates for Existing Families

• Updated extractor for Rhadamanthys
  • Rhadamanthys sample:
    • 260928-jax6saybnb
• Updated extractor for 751Stealer injector
  • 751Stealer sample:
    • 260928-ja96cayt8q
• Updated detection for Spynote, Android RAT
  • Spynote sample:
    • 260911-zy471avycy
• Updated detection for SeroRAT
  • SeroRAT sample:
    • 260928-jbwz4syt9l
• Updated detection for BoratRAT
  • BoratRAT sample:
    • 260928-jb41qayt9r

If you have any feedback, questions, or issues about Triage™ feel free to reach out to us any time - we do our best to respond to all feedback but even if we can’t get back to you straight away your files will go into our list of things to review and help us prioritize tasks.

You can find us directly through the website, or using the Feedback option on an analysis report page.

Not signed up yet? Head over to tria.ge to register for a free account.