Welcome back to our Triage Thursday™ blog series! We’re excited to share this week’s detection updates with you. In these quick posts, we highlight the latest malware families detections that have been added.
New Windows Families This Week
- Added detection and extractor for HarborRAT, Windows RAT
- HarborRAT sample:
- Added detection and extractor for Nexar aka KebabStealer, Windows stealer
- Nexar sample:
- Added detection and extractor for PidoStealer, Windows stealer
- PidoStealer sample:
- Added detection and extractor for MoonPeak, Windows RAT (XenoRAT fork)
- MoonPeak sample:
- Added detection for RegPhantom, Windows backdoor
- RegPhantom sample:
- Added detection for HttpRAT, Windows RAT
- HttpRAT sample:
- Added detection for EnoriStealer, Windows stealer
- EnoriStealer sample:
- Added detection for TCLBANKER, Windows banking trojan
- TCLBANKER sample:
- Added detection and extraction for ApocOmega, Windows malware
- ApocOmega sample:
- Added detection and extraction for ChickenStealer, Windows stealer
- ChickenStealer sample:
- Added detection and extraction for CripStealer, Windows stealer
- CripStealer sample:
- Added detection and extraction for NWHStealer, Windows stealer
- NWHStealer sample:
- Added detection for Psychedelic Stealer and Loaders
- Psychedelic sample:
Detection for macOS
- Added detection and extractor for MioLab, macOS stealer
- MioLab sample:
Detection for Android
- Added detection and extraction for AppPanda, Android banking trojan
- AppPanda sample:
- Added detection for RedWing, Android spyware
- RedWing sample:
Detection for Linux and Network Families
- Added detection for ClingSTUN, Linux botnet
- ClingSTUN sample:
Updates for Existing Families
- Added detection and extraction support for ChromeElevator v2.0
- ChromeElevator sample:
- Updated detection and extractor for NeedleStealer Rust variant
- NeedleStealer sample:
- Updated detection for SalatStealer (memdump with missing header)
- SalatStealer sample:
- Added C2 value check for RedHook, Android RAT
- RedHook sample:
- Added extraction for unextracted Spynote, Android RAT
- Spynote sample:
- Updated detection for AISURU botnet
- AISURU sample:
If you have any feedback, questions, or issues about Triage™ feel free to reach out to us any time - we do our best to respond to all feedback but even if we can’t get back to you straight away your files will go into our list of things to review and help us prioritize tasks.
You can find us directly through the website, or using the Feedback option on an analysis report page.
Not signed up yet? Head over to tria.ge to register for a free account.