Blog.

Welcome back to our Triage Thursday™ blog series! We’re excited to share this week’s detection updates with you. In these quick posts, we highlight the latest malware families detections that have been added.

New Windows Families This Week

• Added detection and extractor for Win-lol, Windows RAT dropper
  • Win-lol samples:
    • stage 1 (loader): 261002-q19e3a1tev
    • stage 2 (payload): 261002-q192lawdrf
    • stage 4 (RAT): 261005-n1awds1hqd
• Added detection for PlagueStealer, Windows stealer
  • PlagueStealer sample:
    • 261005-n1ketsvv3n
• Added detection for ClosedQuorum, Windows backdoor
  • ClosedQuorum sample:
    • 261005-n1awds1hqd
• Added detection and extractor for WailsLoader, Windows loader
  • WailsLoader sample:
    • 261005-n1sq7svzgt
• Added detection for OpsLoader, Windows loader
  • OpsLoader sample:
    • 261002-q17w8syx4q
• Added detection for WaterRAT, Windows RAT
  • WaterRAT sample:
    • 261002-q1rv1swdnh
• Added detection for MLTBackdoor, Windows backdoor
  • MLTBackdoor sample:
    • 261002-q1nhlawdne
• Added detection and extraction for S0ci0Stealer, Windows stealer
  • S0ci0Stealer sample:
    • 261002-q2am5awdrg
• Added detection and extraction for ExistRAT, Windows RAT
  • ExistRAT sample:
    • 261002-q192la1tex
• Added detection for BlueLocker, Windows ransomware
  • BlueLocker sample:
    • 261002-q1771ayx5k
• Added detection for SauronLoader, Windows loader
  • SauronLoader sample:
    • 261002-q2am5ayx6m
• Added detection for Jomangy, Windows backdoor
  • Jomangy sample:
    • 261002-q17w8syx4n
• Added detection and wallet extractor for Remus Clipper, Windows stealer
  • Remus_clipper sample:
    • 261005-gzpvlavepf

Detection for Android

• Added detection for Switcher, Android DNS-hijacking trojan
  • Switcher sample:
    • 261002-q1771ayx4r

Detection for Linux and Network Families

• Added detection for GoDDoSAgent, Linux botnet
  • GoDDoSAgent sample:
    • 261005-n1ybpavv4p
• Added detection for Vibenet, Linux botnet
  • Vibenet sample:
    • 261002-q1771ayx5j

Updates for Existing Families

• Added extraction support for GomoRAT, Windows RAT
  • GomoRAT sample:
    • 261002-q19qtsyx6j
• Added extraction support for VioletWorm aka VioletRat
  • VioletWorm sample:
    • 261002-q185as1td1
• Updated extraction for unextracted Octagon, Android RAT
  • Octagon sample:
    • 261002-q2b6ysyx6p
• Updated detection and config extractor for new version of Amatera botnet
  • Amatera sample:
    • 261002-q19qtsyx6k

If you have any feedback, questions, or issues about Triage™ feel free to reach out to us any time - we do our best to respond to all feedback but even if we can’t get back to you straight away your files will go into our list of things to review and help us prioritize tasks.

You can find us directly through the website, or using the Feedback option on an analysis report page.

Not signed up yet? Head over to tria.ge to register for a free account.