Blog.

Welcome back to our Triage Thursday™ blog series! We’re excited to share this week’s detection updates with you. In these quick posts, we highlight the latest malware families detections that have been added.

New Windows Families This Week

• Added detection and extractor for 2Cloader, Windows loader
  • 2Cloader sample:
    • 261015-q5dtysxsbx
• Added detection for Overstealer, Windows stealer
  • Overstealer samples:
    • JAR: 261015-q5efgsxscs
    • extension: 261015-q5fnjsgt5w
• Added detection and extractor for HyenaStealer, Windows stealer
  • HyenaStealer sample:
    • 261015-ssksvaxyfy
• Added detection and extractor for HemiGate, Windows backdoor
  • HemiGate sample:
    • 261015-q5hsxagt5y
• Added detection and extractor for LiquidRAT, Windows RAT
  • LiquidRAT samples:
    • dropper + client: 261015-q5eq9axscv
    • client: 261015-q5dtysxsby
• Added detection for AsyncRustRAT, Windows RAT
  • AsyncRustRAT sample:
    • 261015-q4kacacg77
• Added detection and extraction for VorishkaStealer, Windows stealer
  • VorishkaStealer sample:
    • 261015-q5hg5sgt5x
• Added detection for SockTz, Windows backdoor
  • SockTz sample:
    • 261015-q5e21sgt5v
• Added detection for SalsaStealer, Windows stealer
  • SalsaStealer sample:
    • 261015-q5d5qaxsbz
• Added detection for ROOFDECK, Windows backdoor
  • ROOFDECK sample:
    • 261016-kn9meavy3l
• Added detection and extraction for WeyhroC2, Windows backdoor
  • WeyhroC2 sample:
    • 261015-q5fzba1y2q
• Added detection for NyxarStealer, Windows stealer
  • NyxarStealer sample:
    • 261016-kpj35sb14w

Detection for Android

• Added detection for Chamois, Android botnet
  • Chamois sample:
    • 261015-q5gwls1y3l
• Added detection for HeroRAT, Android RAT
  • HeroRAT sample:
    • 261016-kp29qazza1
• Added detection for RatHat, Android banking trojan
  • RatHat samples:
    • APK: 261016-kqjh1acs2m
    • ELF .so payload: 261015-q5eq9axsct

Updates for Existing Families

• Updated detection and extractor for Remus Stealer
  • Remus sample:
    • 261016-kq2pkszzb1

If you have any feedback, questions, or issues about Triage™ feel free to reach out to us any time - we do our best to respond to all feedback but even if we can’t get back to you straight away your files will go into our list of things to review and help us prioritize tasks.

You can find us directly through the website, or using the Feedback option on an analysis report page.

Not signed up yet? Head over to tria.ge to register for a free account.