Welcome back to our Triage Thursday™ blog series! We’re excited to share this week’s detection updates with you. In these quick posts, we highlight the latest malware families detections that have been added.
New Windows Families This Week
- Added detection and extractor for CloudHaze, Windows backdoor
- CloudHaze sample:
- Added detection for WardenStealer, Windows stealer
- WardenStealer sample:
- Added detection and extractor for InsomniaRAT, Windows RAT
- InsomniaRAT samples:
- Node.js stage: 261110-l23xfsed94
- Python stage: 261110-l291rs1yht
- InsomniaRAT samples:
- Added detection and extractor for ArkTunnel, Windows backdoor
- ArkTunnel samples:
- implant: 261110-l29p1a1yg1
- loader + extractor: 261110-mdme8s11ay
- ArkTunnel samples:
- Added detection for Docro, Windows adware
- Docro sample:
- Added detection for IronRAT, Windows RAT
- IronRAT sample:
- Added detection for MonoxideRAT, Windows RAT
- MonoxideRAT sample:
- Added detection and extraction for Antino, Windows malware
- Antino sample:
- Added detection for Zalmoxis Stealer, Windows stealer
- Zalmoxis sample:
- Added detection for SleekHook, Windows malware
- SleekHook sample:
- Added detection and config extractor for DarkCoreRAT, Windows RAT
- DarkCore sample:
Detection for Android
- Added detection and extraction for Black Hawk, Android RAT
- BlackHawk samples:
- stage 2 decrypted APK: 261019-j244easwg1
- BlackHawk samples:
- Added detection and extraction for Hirudo, Android banking trojan
- Hirudo sample:
Detection for Linux Families
- Added detection and extractor for AveRAT, Linux backdoor
- AveRAT samples:
- with extractor: 261110-mk9jcahz9y
- dropper (detection only): 261110-l213vsed87
- AveRAT samples:
Detection for Ransomware (Ransomnote Attribution)
Updates for Existing Families
- Updated detection for new version of BPFDOOR implant
- BPFDoor sample:
- Updated detection for StealC
- StealC sample:
- Updated extraction for MantaxOtax, Android ransomware and spyware
- MantaxOtax sample:
If you have any feedback, questions, or issues about Triage™ feel free to reach out to us any time - we do our best to respond to all feedback but even if we can’t get back to you straight away your files will go into our list of things to review and help us prioritize tasks.
You can find us directly through the website, or using the Feedback option on an analysis report page.
Not signed up yet? Head over to tria.ge to register for a free account.