Malware Monthly Update January - 2020

Malware Strikes

Strike ID Malware Platform Info MD5 External References
M20-v8y01Formbook_18ec3b4dWindows This strike sends a malware sample known as Formbook. This malicious sample is known as Formbook. Formbook is an information stealer that attempts to collect sensitive information from the target.18ec3b4da78d2fed6b98db0a6ae813a6https://blog.talosintelligence.com/2020/01/threat-roundup-0103-0110.html 2e98ffc7f5bab8e3f2085beba2ecc912f038c9a66a5f6b9ec7d8e0f2eca2fcbc 0c98a8191c1ae3e9ee746adf835ffcb628451e3f 18ec3b4da78d2fed6b98db0a6ae813a6
M20-cdm01Barys_f23fb0e7Windows This strike sends a malware sample known as Barys. Barys is a trojan and downloader that will upload malicious files to the victim machine.f23fb0e72a5ca3213b3aa2ae87c2e4cfhttps://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html 0780a44389bf1a4cde74cc26d87cf3ee10ab0f19ba75dc941abacb0939f6c0fd daaf4bd92f9d84ff5777b0939f72b80d73fdff4d f23fb0e72a5ca3213b3aa2ae87c2e4cf
M20-xsf01Upatre_8afdffe2Windows This strike sends a malware sample known as Upatre. Upatre is a malicious downloader often used by exploit kits and phishing campaigns. Upatre downloads and executes malicious executables, such as banking malware.8afdffe2fe9b8afb36a33596744dbb96https://blog.talosintelligence.com/2020/01/threat-roundup-0103-0110.html 062720c82d1bef7558b0a4675b9539a23afddf252ede24b5d54edfba2a758ca5 39d987162051347f2844293bac51d4908971f9ce 8afdffe2fe9b8afb36a33596744dbb96
M20-snk01ZeroAccess_82478302Windows This strike sends a malware sample known as ZeroAccess. This sample is known as ZeroAccess. ZeroAccess is a trojan that infects Windows systems, installing a rootkit to hide its presence on the affected machine and serves as a platform for conducting click-fraud campaigns.82478302003ed046a22eb157f8e219a0https://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html 24ec81e3c8a7247c0fa2292906afccc1d47b81412cfaf021dc22be067530e944 86367c293efa5803a55e998700ba49ad84adc19e 82478302003ed046a22eb157f8e219a0
M20-in501JhoneRATAutoIT_1807e27fWindows This strike sends a malware sample known as JhoneRATAutoIT. This sample is an AutoIT script that will retrieve the Python RAT from the cloud provider as the third stage of JhoneRAT.1807e27f6badbb199e95e6d3abdae1dchttps://blog.talosintelligence.com/2020/01/jhonerat.html b4a43b108989d1dde87e58f1fd6f81252ef6ae19d2a5e8cd76440135e0fd6366 579c10219b962b96a5f84010f29eba2c387ef4c5 1807e27f6badbb199e95e6d3abdae1dc
M20-9d401ZeroAccess_d396a27dWindows This strike sends a malware sample known as ZeroAccess. This sample is known as ZeroAccess. ZeroAccess is a trojan that infects Windows systems, installing a rootkit to hide its presence on the affected machine and serves as a platform for conducting click-fraud campaigns.d396a27d4a14012788b50722167eba35https://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html 05597af5ff2dd97b20b7c57e4c3cd48cae1a4d2c7cd1c4ac920a6f1185a65900 3fe1c0f3df13e1e5b8820864deb0270d6b81abdf d396a27d4a14012788b50722167eba35
M20-ehv01ZeroAccess_e1545fb1Windows This strike sends a malware sample known as ZeroAccess. This sample is known as ZeroAccess. ZeroAccess is a trojan that infects Windows systems, installing a rootkit to hide its presence on the affected machine and serves as a platform for conducting click-fraud campaigns.e1545fb11d032ad4b027034ebeed2399https://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html 1c9dc1eb7cb0191101faa393854592a440d6df736f07a767138df22c1f809c8d ab24e79d858cc4d55393f3d0cafdf8ef0d0f623a e1545fb11d032ad4b027034ebeed2399
M20-mzk01Razy_2aa87ee2Windows This strike sends a malware sample known as Razy. This malicious sample is known as Razy. Razy is often used as a generic detection name for a Windows trojan.2aa87ee2b7baa7d413cc747537a867a2https://blog.talosintelligence.com/2020/01/threat-roundup-0103-0110.html cdaef1b003e82f8994dd616103781125fca98ec097ee79830c2262f41158237a ee004c039ed066dd237c465c33e23e7abb8fb34f 2aa87ee2b7baa7d413cc747537a867a2
M20-p3401Formbook_22f52791Windows This strike sends a malware sample known as Formbook. This malicious sample is known as Formbook. Formbook is an information stealer that attempts to collect sensitive information from the target.22f527912f273610f0f29c239c8b21ebhttps://blog.talosintelligence.com/2020/01/threat-roundup-0103-0110.html 356aa1a0e39cd24ed61ca8c1d6658a91c9dd8dbd2663ce90b5db2b793fe12e01 94d44e5ed007a5273d70d257ee0d0545d281fe67 22f527912f273610f0f29c239c8b21eb
M20-jyl01njRAT_16c2f9b6Windows This strike sends a malware sample known as njRAT. This malicious sample known as njRAT is also known as Bladabindi. It is a remote access trojan (RAT) that allows attackers to execute commands on the infected host, log keystrokes and remotely turn on the victim's webcam and microphone. njRAT was developed by the Sparclyheason group. Some of the largest attacks using this malware date back to 2014.16c2f9b6c3b80cfeb40c8a5ec9c0f17fhttps://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html 53b7c2eadbb2686d6bcfed439d656df597b396f0004b086a9aad6806e7810256 1428b8adb2f515bfb9ee222833a9c49ef19c4d47 16c2f9b6c3b80cfeb40c8a5ec9c0f17f
M20-jv101Razy_0748af39Windows This strike sends a malware sample known as Razy. This malicious sample is known as Razy. Razy is often used as a generic detection name for a Windows trojan.0748af3992de6e3aa7b386b7f6c08ef2https://blog.talosintelligence.com/2020/01/threat-roundup-0103-0110.html 3031363a67eca33c68892ed7529803bbaa926a6f371204eeaa8ca205501d8cac 4f07ba441cd12dc12c8525536409cf5fffe1460b 0748af3992de6e3aa7b386b7f6c08ef2
M20-4xb01Formbook_657a107fWindows This strike sends a malware sample known as Formbook. This malicious sample is known as Formbook. Formbook is an information stealer that attempts to collect sensitive information from the target.657a107f2875178c5bc79d39602986cbhttps://blog.talosintelligence.com/2020/01/threat-roundup-0103-0110.html 2a13033c3b6b7299bd795ce5c34bbba17a8de80d4d957e4d547ef1ae2ba728b4 3614dee3fb859c76a66cde46f111e8db142eeb58 657a107f2875178c5bc79d39602986cb
M20-0y101Razy_4bd65e3eWindows This strike sends a malware sample known as Razy. This malicious sample is known as Razy. Razy is often used as a generic detection name for a Windows trojan.4bd65e3efec3e9dc779bff402eb168b5https://blog.talosintelligence.com/2020/01/threat-roundup-0103-0110.html 79acdd5ea559b2e7e29fa6b47ca1053e11dbaadf540fc2b140aca89d1539d17e bf2d681c69bcd80cb127e053098a346cd2946b15 4bd65e3efec3e9dc779bff402eb168b5
M20-cvf01Razy_eb9064afWindows This strike sends a malware sample known as Razy. This malicious sample is known as Razy. Razy is often used as a generic detection name for a Windows trojan.eb9064af85850cf7b3485b2a911798d7https://blog.talosintelligence.com/2020/01/threat-roundup-0103-0110.html 731aa2659852eb9b98d573b3f59436b49c15492d8df94e18da5a8f4c41f48fbe ae6d9af60afb81ad1078c78189572f50dabe3b75 eb9064af85850cf7b3485b2a911798d7
M20-20f01Barys_4283b4aaWindows This strike sends a malware sample known as Barys. Barys is a trojan and downloader that will upload malicious files to the victim machine.4283b4aa2e7b1cba360bc9265494c0b9https://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html 006261e3d8b0d00ae9f6596dd914440a19b1b0ab333533c03fd75c3e63f07f0d 56828ad5dada707158a6f1b23227b03456373a14 4283b4aa2e7b1cba360bc9265494c0b9
M20-mf101Barys_fa225720Windows This strike sends a malware sample known as Barys. Barys is a trojan and downloader that will upload malicious files to the victim machine.fa225720e442680e287e27be96b4513fhttps://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html 18f55fa2f805d9a0aa51b6c6e934b9ea14d4c63fb578811dad1d7816e5758b71 82f2eb8e876bcae15fb8865335da7405724632f1 fa225720e442680e287e27be96b4513f
M20-3kw01Dridex_33122331Windows This strike sends a malware sample known as Dridex. Dridex is an online banking malware that steals personal information through HTML injections. It was first spotted at the end of 2014 and its inventors keep improving it periodically since then. The latest improvement is the addition of AtomBombing technique (does not exploit any vulnerabilities but uses a design falw in Windows related to system-level Atom Tables) which makes Dridex harder to detect by antiviruses.331223318ff468a3ae5b490dd28eaa34https://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html 940eaff21163abfe8be6301e561e30a27f23800cb8bfe4a5df9a5ff7dbfb1d4f d1bca6c86a81e586e3bfb0610593bd80b696c76d 331223318ff468a3ae5b490dd28eaa34
M20-ft001ZeroAccess_a58d371bWindows This strike sends a malware sample known as ZeroAccess. This sample is known as ZeroAccess. ZeroAccess is a trojan that infects Windows systems, installing a rootkit to hide its presence on the affected machine and serves as a platform for conducting click-fraud campaigns.a58d371b07a51f78167a1ed2cedc1149https://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html 0b675bae551f40fe43934915324927652e35fa3089dcc911345478fc96338a3c 5b16da423736f57ca1bf8ac655f77043988b2716 a58d371b07a51f78167a1ed2cedc1149
M20-xvu01Razy_1c3dda80Windows This strike sends a malware sample known as Razy. This malicious sample is known as Razy. Razy is often used as a generic detection name for a Windows trojan.1c3dda8020173a5b45a7c80cfc8b0298https://blog.talosintelligence.com/2020/01/threat-roundup-0103-0110.html 34b978969d994134de71dd45996dc5d10516e534e23a2abb8537a1c548ac1c93 b813b491477a42596a90b7c5b29dc4a013f7b3a9 1c3dda8020173a5b45a7c80cfc8b0298
M20-xan01Formbook_6c94358aWindows This strike sends a malware sample known as Formbook. This malicious sample is known as Formbook. Formbook is an information stealer that attempts to collect sensitive information from the target.6c94358a5054c3b0cd48bead515c29e1https://blog.talosintelligence.com/2020/01/threat-roundup-0103-0110.html 2655a1ee89ed4101f552ce1b75b9d711ee5c6217e63cf6ce8e23086844c839e9 b1977aa9377bc7668bebdbe1a42b1cdde607f923 6c94358a5054c3b0cd48bead515c29e1
M20-32801Formbook_0df65c4cWindows This strike sends a malware sample known as Formbook. This malicious sample is known as Formbook. Formbook is an information stealer that attempts to collect sensitive information from the target.0df65c4c62808537fbb360bd7f001c63https://blog.talosintelligence.com/2020/01/threat-roundup-0103-0110.html 36fd577a0a6354cae84ff7a6bc3b21159f24cd0b8eff3482ba7c8278b4a89b27 7ce30a84ff446f849ab5aa77c46752ab271273b5 0df65c4c62808537fbb360bd7f001c63
M20-x6i01Upatre_61f7ce62Windows This strike sends a malware sample known as Upatre. Upatre is a malicious downloader often used by exploit kits and phishing campaigns. Upatre downloads and executes malicious executables, such as banking malware.61f7ce62172d549ed46481e97b939831https://blog.talosintelligence.com/2020/01/threat-roundup-0103-0110.html 16b232d226ca18447e1f1671538607fe5be412e935b930bcde73ff46e0b2890f fd50f790dd99d0c9b4f412a7bfeae8aa8fea3e74 61f7ce62172d549ed46481e97b939831
M20-tzz01TeslaCrypt_72939fdcWindows This strike sends a malware sample known as TeslaCrypt. This sample is known as TeslaCrypt.72939fdcaabdb51a87d5cef1faaa8710https://blog.talosintelligence.com/2020/01/threat-roundup-0103-0110.html 6352e2794884e3c090f6ec14ec8c870fdc6d4cde61f518c44ed5bae2916e67c8 f85fcd8f46d964019af369c4773646ab3e1c05de 72939fdcaabdb51a87d5cef1faaa8710
M20-4ih01njRAT_c82ed5e2Windows This strike sends a malware sample known as njRAT. This malicious sample known as njRAT is also known as Bladabindi. It is a remote access trojan (RAT) that allows attackers to execute commands on the infected host, log keystrokes and remotely turn on the victim's webcam and microphone. njRAT was developed by the Sparclyheason group. Some of the largest attacks using this malware date back to 2014.c82ed5e27702f79bd99befba36f86e54https://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html 162616259b6591503807bda2b9228c88409f4a71c085bc4b39d5eef2b64213c9 83df2b31b5334085f3819dd47c26ed05183c00bb c82ed5e27702f79bd99befba36f86e54
M20-dvb01Upatre_e14cea82Windows This strike sends a malware sample known as Upatre. Upatre is a malicious downloader often used by exploit kits and phishing campaigns. Upatre downloads and executes malicious executables, such as banking malware.e14cea82a38aab83b9ea969e5a4d7107https://blog.talosintelligence.com/2020/01/threat-roundup-0103-0110.html 09f38837949bbee74dd5da5fce7a92d7f21168f7e43345bbd19f5cbfde8f6f69 6253af6c56a3fdd109500b39121a75a0c646869d e14cea82a38aab83b9ea969e5a4d7107
M20-6l601ZeroAccess_5ea7af4aWindows This strike sends a malware sample known as ZeroAccess. This sample is known as ZeroAccess. ZeroAccess is a trojan that infects Windows systems, installing a rootkit to hide its presence on the affected machine and serves as a platform for conducting click-fraud campaigns.5ea7af4a0e5ffd931a3c781669c6f2eahttps://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html 330719fd8491c5abc9fd90c7e27310cb72d331222c5caaf4671525d48e4b1026 ebc8f725b8f39cc56b2da3d696712a1ab6568bf0 5ea7af4a0e5ffd931a3c781669c6f2ea
M20-7mf01njRAT_3e3232c4Windows This strike sends a malware sample known as njRAT. This malicious sample known as njRAT is also known as Bladabindi. It is a remote access trojan (RAT) that allows attackers to execute commands on the infected host, log keystrokes and remotely turn on the victim's webcam and microphone. njRAT was developed by the Sparclyheason group. Some of the largest attacks using this malware date back to 2014.3e3232c43766e13efe5bcac004bc24a2https://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html 461ec9be4e72154e7faebde91b452dbf0c22281405f0966eeddf69330f91ad2d a4aa4af1bdf31422b0e97655b244a512bda035c5 3e3232c43766e13efe5bcac004bc24a2
M20-z8x01njRAT_629bdc55Windows This strike sends a malware sample known as njRAT. This malicious sample known as njRAT is also known as Bladabindi. It is a remote access trojan (RAT) that allows attackers to execute commands on the infected host, log keystrokes and remotely turn on the victim's webcam and microphone. njRAT was developed by the Sparclyheason group. Some of the largest attacks using this malware date back to 2014.629bdc5564b12b83e373a0e084275fb2https://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html 3022c3729827f0f7ea739b18b073e6c488ce6481eedaae147cc33738401d131e a0e7363bcb6669fa1464fb11b233b5ca03f2eb08 629bdc5564b12b83e373a0e084275fb2
M20-y1v01njRAT_321fa623Windows This strike sends a malware sample known as njRAT. This malicious sample known as njRAT is also known as Bladabindi. It is a remote access trojan (RAT) that allows attackers to execute commands on the infected host, log keystrokes and remotely turn on the victim's webcam and microphone. njRAT was developed by the Sparclyheason group. Some of the largest attacks using this malware date back to 2014.321fa623f85babd76ef432d901600265https://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html 0462bc4b60370728471971b9326c2e1540370809292ffd6cb5791a61df705bf9 c245997df9eb33f7446bfb84431e603a9b2ea74f 321fa623f85babd76ef432d901600265
M20-kog01TeslaCrypt_27098f55Windows This strike sends a malware sample known as TeslaCrypt. This sample is known as TeslaCrypt.27098f554fd06cb593553403a5336fa5https://blog.talosintelligence.com/2020/01/threat-roundup-0103-0110.html 00de6704e49ec7e8b570b95410704c0d3d81c727c688d06afe68e4f8f4e4b8e6 9dd57b44fc12f00d3a82217323f9586a4678d775 27098f554fd06cb593553403a5336fa5
M20-z6o01ZeroAccess_7f628b08Windows This strike sends a malware sample known as ZeroAccess. This sample is known as ZeroAccess. ZeroAccess is a trojan that infects Windows systems, installing a rootkit to hide its presence on the affected machine and serves as a platform for conducting click-fraud campaigns.7f628b08d4074bdb0a79190a58dc9b80https://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html 2460096ab6403840c5de8a19dc1706cf2dc416cc9e3ab701275853d66eb7e142 435e02e40026af77e7ccc0348d0a9fdeaa50dc9a 7f628b08d4074bdb0a79190a58dc9b80
M20-j8a01Upatre_132965ebWindows This strike sends a malware sample known as Upatre. Upatre is a malicious downloader often used by exploit kits and phishing campaigns. Upatre downloads and executes malicious executables, such as banking malware.132965eb90b824043b7d785baaf5a164https://blog.talosintelligence.com/2020/01/threat-roundup-0103-0110.html 1d2374db5ee92385e49fbaef9ef694361877cdffa4b51d8fd8d37e6272dfad57 b08e753b34cf1901c0ea0a1fde047dba188aa18f 132965eb90b824043b7d785baaf5a164
M20-jvk01ZeroAccess_252b9f1bWindows This strike sends a malware sample known as ZeroAccess. This sample is known as ZeroAccess. ZeroAccess is a trojan that infects Windows systems, installing a rootkit to hide its presence on the affected machine and serves as a platform for conducting click-fraud campaigns.252b9f1b0757af8c0d8e8c37ff270f1bhttps://blog.talosintelligence.com/2020/01/threat-roundup-0110a94e7.html 3e6c74185843c930a9b5ea041a5a3eef7d9ae80a31e3a67e0c235b5090e64afb b205003afa6664e64f347994a94ec009673f3e48 252b9f1b0757af8c0d8e8c37ff270f1b
M20-jmn01njRAT_1e598ed5Windows This strike sends a malware sample known as njRAT. This malicious sample known as njRAT is also known as Bladabindi. It is a remote access trojan (RAT) that allows attackers to execute commands on the infected host, log keystrokes and remotely turn on the victim's webcam and microphone. njRAT was developed by the Sparclyheason group. Some of the largest attacks using this malware date back to 2014.1e598ed5607c7b856a81b02e1aade5bchttps://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html 63779c53cc4ab5d02daadffdd2f7b93b3bfc1a137eb1e5a895d7e2b8393f42a5 e3fde24ebeeed22aba47561f5d167d5348f2f74c 1e598ed5607c7b856a81b02e1aade5bc
M20-eft01Upatre_d32f8ea0Windows This strike sends a malware sample known as Upatre. Upatre is a malicious downloader often used by exploit kits and phishing campaigns. Upatre downloads and executes malicious executables, such as banking malware.d32f8ea0d2d4e4fba1db97bebb9ab0aahttps://blog.talosintelligence.com/2020/01/threat-roundup-0103-0110.html 186a59f2954d3d213a26308386be80f2b503e08882324ab559490330700fc24a 6573d19570a2b8e315a2f2c3054a16a7822c9a3c d32f8ea0d2d4e4fba1db97bebb9ab0aa
M20-08b01Dridex_b1794476Windows This strike sends a malware sample known as Dridex. Dridex is an online banking malware that steals personal information through HTML injections. It was first spotted at the end of 2014 and its inventors keep improving it periodically since then. The latest improvement is the addition of AtomBombing technique (does not exploit any vulnerabilities but uses a design falw in Windows related to system-level Atom Tables) which makes Dridex harder to detect by antiviruses.b1794476fba028a5429431aa4b5c7399https://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html 0a3079b8c4963b26e74760337da6cb0b1a6c532cc524f4d0aae6dab1d52f7d75 10a0141e106be3a8f4244a12fe29a24b58539afd b1794476fba028a5429431aa4b5c7399
M20-gjf01ZeroAccess_4bcde02bWindows This strike sends a malware sample known as ZeroAccess. This sample is known as ZeroAccess. ZeroAccess is a trojan that infects Windows systems, installing a rootkit to hide its presence on the affected machine and serves as a platform for conducting click-fraud campaigns.4bcde02b890119bf6f7f632d1d101e3fhttps://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html 2b275de3b1d0f2786c58f17a0d2607a47dade5151046f255eea2f9da20a03c9c fca0661cbb5bed98a6a3bd0cf537cd2735e69308 4bcde02b890119bf6f7f632d1d101e3f
M20-ql901njRAT_c5a19faaWindows This strike sends a malware sample known as njRAT. This malicious sample known as njRAT is also known as Bladabindi. It is a remote access trojan (RAT) that allows attackers to execute commands on the infected host, log keystrokes and remotely turn on the victim's webcam and microphone. njRAT was developed by the Sparclyheason group. Some of the largest attacks using this malware date back to 2014.c5a19faa5b8b5d6790497e5bb45194cfhttps://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html 1846cfe96f4733d9cc7620cff603abdf1c44fe2f84d34daa79c14b04a726357d 1bff9247e7f71c437651f788e34f9aaeb29b1fe0 c5a19faa5b8b5d6790497e5bb45194cf
M20-60i01ZeroAccess_72e3c8bdWindows This strike sends a malware sample known as ZeroAccess. This sample is known as ZeroAccess. ZeroAccess is a trojan that infects Windows systems, installing a rootkit to hide its presence on the affected machine and serves as a platform for conducting click-fraud campaigns.72e3c8bdadd54101d1775118339c8e00https://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html 1ac467786827d37bc69e30617fa2b14fa8903f68f73022e727caa634379490b2 ef2c280f4b2664c0c67158eddd9d67320d5cb5f0 72e3c8bdadd54101d1775118339c8e00
M20-hb301JhoneRATPython_7ef4acccWindows This strike sends a malware sample known as JhoneRATPython. This sample is the Python Remote Access Trojan. It targets Middle Eastern countries by detecting the target's keyboard layout and uses several cloud services to perform its command and control functions.7ef4accc31ccbce777cbde68ffa1caechttps://blog.talosintelligence.com/2020/01/jhonerat.html 4228a5719a75be2d6658758fc063bd07c1774b44c10b00b958434421616f1548 a00cbf454c6b8db90fe5e8480e7f03b73f4e6873 7ef4accc31ccbce777cbde68ffa1caec
M20-uhz01Formbook_3d026e99Windows This strike sends a malware sample known as Formbook. This malicious sample is known as Formbook. Formbook is an information stealer that attempts to collect sensitive information from the target.3d026e99a1a14cfd5aa3045613454b8ehttps://blog.talosintelligence.com/2020/01/threat-roundup-0103-0110.html 07c11047e72c8f52c1f5c422fc5b7ed49225259012c813c2bc5a8827bcf5f752 71bc8ff80b7d67cff2f22470af79093a4063c908 3d026e99a1a14cfd5aa3045613454b8e
M20-klc01Formbook_5d7a7338Windows This strike sends a malware sample known as Formbook. This malicious sample is known as Formbook. Formbook is an information stealer that attempts to collect sensitive information from the target.5d7a7338d170ba1a3ab7d8949721f032https://blog.talosintelligence.com/2020/01/threat-roundup-0103-0110.html 058392f97319e50bbd2172ab46255c892e12ee0b7948e6ce0420012eb85e7e35 786124c5d5bae5a981ad9df4bb5e97f09cf72f9c 5d7a7338d170ba1a3ab7d8949721f032
M20-ys701ZeroAccess_cd21e511Windows This strike sends a malware sample known as ZeroAccess. This sample is known as ZeroAccess. ZeroAccess is a trojan that infects Windows systems, installing a rootkit to hide its presence on the affected machine and serves as a platform for conducting click-fraud campaigns.cd21e511250ab50f4ed232f497770f4chttps://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html 02a6714aebbfef68f0528f10414a2fd8a8338243e05992d0c28d68383e1dc1a1 050dc56d03e923feec723fdac4db0bc823c490b2 cd21e511250ab50f4ed232f497770f4c
M20-j8v01Formbook_af67ca8aWindows This strike sends a malware sample known as Formbook. This malicious sample is known as Formbook. Formbook is an information stealer that attempts to collect sensitive information from the target.af67ca8a7f1533f6b4019deb0ca3c7cfhttps://blog.talosintelligence.com/2020/01/threat-roundup-0103-0110.html 3aa7710feab8dd35997e03ad650a5bae2f19de1d82e2a7fef032815d946e21ee c9c14cc557b07f5882e606379d9e4aad1fc46429 af67ca8a7f1533f6b4019deb0ca3c7cf
M20-8in01JhoneRATTemplate_f2e74125Mixed This strike sends a malware sample known as JhoneRATTemplate. This malicious sample is known as JhoneRAT. JhoneRAT is Remote Access Trojan developed in Python that is delivered by means of an office document, and then delivers payloads via multiple layers hosted by Cloud based providers in order to avoid blacklisting. This sample Is the template downloaded from the initial office documents. The document executes a macro that retrieves an image from a new Google drive location.f2e741253b8085bc9e738cc5ae50e735https://blog.talosintelligence.com/2020/01/jhonerat.html 6cc0c11c754e1e82bca8572785c27a364a18b0822c07ad9aa2dc26b3817b8aa4 0ce95e5bdd8ff77f0d3e208f168a1aa943c4a920 f2e741253b8085bc9e738cc5ae50e735
M20-y7b01ZeroAccess_bffea878Windows This strike sends a malware sample known as ZeroAccess. This sample is known as ZeroAccess. ZeroAccess is a trojan that infects Windows systems, installing a rootkit to hide its presence on the affected machine and serves as a platform for conducting click-fraud campaigns.bffea87815b6a3ea663b441b71687d0chttps://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html 37240db16c496c45552715904b84ce5cc2c1e01ebbcf519a7e0bee4cc73f08bd 5063014da599f020d5af8ed7b7e35f048920510a bffea87815b6a3ea663b441b71687d0c
M20-vn001Formbook_bb0f5ecfWindows This strike sends a malware sample known as Formbook. This malicious sample is known as Formbook. Formbook is an information stealer that attempts to collect sensitive information from the target.bb0f5ecf92265237f5809095f039a7e2https://blog.talosintelligence.com/2020/01/threat-roundup-0103-0110.html 3d2f8ca93b256a27067969eda8d4fca7559e38b8af59a79c40c40c55f06b53d2 1d14c2dc02103b27a1bc3c796310c70c1d25e896 bb0f5ecf92265237f5809095f039a7e2
M20-toq01ZeroAccess_5b90bf12Windows This strike sends a malware sample known as ZeroAccess. This sample is known as ZeroAccess. ZeroAccess is a trojan that infects Windows systems, installing a rootkit to hide its presence on the affected machine and serves as a platform for conducting click-fraud campaigns.5b90bf12ad5d15055eb9331553869deehttps://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html 15d09a26dec6c151966a24bfebd38fb67c8397a06c3bf1702eb4702a871a9e2c 9bc8b0006575ce6d33f1997884e834b1ce675908 5b90bf12ad5d15055eb9331553869dee
M20-x8l01Razy_802784b0Windows This strike sends a malware sample known as Razy. This malicious sample is known as Razy. Razy is often used as a generic detection name for a Windows trojan.802784b01a585213ca78723ef65b2ea1https://blog.talosintelligence.com/2020/01/threat-roundup-0103-0110.html 5be87b343f2d3af80883ed4deb795c0ae8f7e0ae4ba08a6bbac5b3e4659d0341 4ec42e7959e36cd12d61576c9112111b2612769f 802784b01a585213ca78723ef65b2ea1
M20-blc01Upatre_19af7b08Windows This strike sends a malware sample known as Upatre. Upatre is a malicious downloader often used by exploit kits and phishing campaigns. Upatre downloads and executes malicious executables, such as banking malware.19af7b084018f59d865c3479bc26dc7bhttps://blog.talosintelligence.com/2020/01/threat-roundup-0103-0110.html 2119922518bc437c7d5fd7d7205929089a9ed9333cdff97bb214808f37e86dd7 4f42a21024f159682bfa58dd0d20dbf5c9c8da3d 19af7b084018f59d865c3479bc26dc7b
M20-vrq01Formbook_20c79d8cWindows This strike sends a malware sample known as Formbook. This malicious sample is known as Formbook. Formbook is an information stealer that attempts to collect sensitive information from the target.20c79d8c4962e12ed1321e53832f0795https://blog.talosintelligence.com/2020/01/threat-roundup-0103-0110.html 0146d4a89836ecc12759c33a85d60c3867a35b7ee468041fb26b0610ef76e54f 315864ef68049185ebd3b367a16d5da7bb76d5f8 20c79d8c4962e12ed1321e53832f0795
M20-wb101TeslaCrypt_1b1a45beWindows This strike sends a malware sample known as TeslaCrypt. This sample is known as TeslaCrypt.1b1a45be73fae7e2ad034a431a18ee1chttps://blog.talosintelligence.com/2020/01/threat-roundup-0103-0110.html 7f1a0f921a5132b1329dbdbfadc83eec6568ad151d1c33da89a4aaf0a5e5c0c2 2547409f019df3125ad7cd1693639de831742bb4 1b1a45be73fae7e2ad034a431a18ee1c
M20-zc201Upatre_f8da0bfbWindows This strike sends a malware sample known as Upatre. Upatre is a malicious downloader often used by exploit kits and phishing campaigns. Upatre downloads and executes malicious executables, such as banking malware.f8da0bfb896b790ad4059bc52a812303https://blog.talosintelligence.com/2020/01/threat-roundup-0103-0110.html 1fcbef293371203729eca2c9491641a03b2330c9be11b438f84db0e996e5b78c 343323df26cd18bb8bf331ba6326cf0f133fa75b f8da0bfb896b790ad4059bc52a812303
M20-rnq01Upatre_5c7c0cc6Windows This strike sends a malware sample known as Upatre. Upatre is a malicious downloader often used by exploit kits and phishing campaigns. Upatre downloads and executes malicious executables, such as banking malware.5c7c0cc65ffba02eec0bc7aeedb5f12bhttps://blog.talosintelligence.com/2020/01/threat-roundup-0103-0110.html 06f92e4b684161224f68388d8d4ca35d113682fadeb2e100072dfa8d43413101 e02314b12f7586375d936a4e44eb8f9db4e81ac0 5c7c0cc65ffba02eec0bc7aeedb5f12b
M20-ow801Upatre_97a2aa2cWindows This strike sends a malware sample known as Upatre. Upatre is a malicious downloader often used by exploit kits and phishing campaigns. Upatre downloads and executes malicious executables, such as banking malware.97a2aa2c76eb158174c325e2c3db903dhttps://blog.talosintelligence.com/2020/01/threat-roundup-0103-0110.html 01152de6c7c348fa9716c3d760744689eb85386303593e6100f6532bd3fc2cb3 91faeda480ccdb3dce3a093e95a07aa63a3f4655 97a2aa2c76eb158174c325e2c3db903d
M20-blp01Upatre_a20d906fWindows This strike sends a malware sample known as Upatre. Upatre is a malicious downloader often used by exploit kits and phishing campaigns. Upatre downloads and executes malicious executables, such as banking malware.a20d906f2bbba431b1e29f5749e8584dhttps://blog.talosintelligence.com/2020/01/threat-roundup-0103-0110.html 0d90667089d17e2924b00e5207a357156e9076dfa3dab3f2e7dc5737135053a9 63e02f7037dcc4e86377850a19eaa712a7aa8265 a20d906f2bbba431b1e29f5749e8584d
M20-lht01Formbook_3c7ff0f5Windows This strike sends a malware sample known as Formbook. This malicious sample is known as Formbook. Formbook is an information stealer that attempts to collect sensitive information from the target.3c7ff0f53a2d0f6b22f0ffcd78830843https://blog.talosintelligence.com/2020/01/threat-roundup-0103-0110.html 2fb1d73ee16fea837612ff0d9c89a934e5520310f9a06397f7e2c1a0c1604694 797e050be980c69bdcada1cc03a5097ec999f127 3c7ff0f53a2d0f6b22f0ffcd78830843
M20-be601Dridex_11bcb183Windows This strike sends a malware sample known as Dridex. Dridex is an online banking malware that steals personal information through HTML injections. It was first spotted at the end of 2014 and its inventors keep improving it periodically since then. The latest improvement is the addition of AtomBombing technique (does not exploit any vulnerabilities but uses a design falw in Windows related to system-level Atom Tables) which makes Dridex harder to detect by antiviruses.11bcb183bd8f3bc81753aae006085e2ehttps://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html 0f4f25d12a2729552a348fb33cd7374fbd5ce3bc53c8da873f3aa5026a7290ca 0a9a2472a8212bf275a85a9ec31531db22b70980 11bcb183bd8f3bc81753aae006085e2e
M20-8gt01njRAT_adb35aa7Windows This strike sends a malware sample known as njRAT. This malicious sample known as njRAT is also known as Bladabindi. It is a remote access trojan (RAT) that allows attackers to execute commands on the infected host, log keystrokes and remotely turn on the victim's webcam and microphone. njRAT was developed by the Sparclyheason group. Some of the largest attacks using this malware date back to 2014.adb35aa75fd7cc4d886ea6113b5ce6b1https://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html 2c55658cf368c0f4f16b9f142e6ee6adb91362c79eb5ecab77d93852b35b7599 350bfad683da2bf47188813a29f87015de9eed44 adb35aa75fd7cc4d886ea6113b5ce6b1
M20-aoy01Barys_84abfbc2Windows This strike sends a malware sample known as Barys. Barys is a trojan and downloader that will upload malicious files to the victim machine.84abfbc25b7ea8af4d7216ac8a325ad4https://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html 004e01f888cb6241fc7da95d1798830ed0c52ea179b1ed0b2f71598e7d83fdc4 f20a1b405547143b3ba8e404294f4b73a086cb88 84abfbc25b7ea8af4d7216ac8a325ad4
M20-a0n01Upatre_724c32c2Windows This strike sends a malware sample known as Upatre. Upatre is a malicious downloader often used by exploit kits and phishing campaigns. Upatre downloads and executes malicious executables, such as banking malware.724c32c2a1c081f2b5f4a1e4bcd764a6https://blog.talosintelligence.com/2020/01/threat-roundup-0103-0110.html 13f7895a32eb09a5016a408819dce9c95a4149888ad708c0232e0659e2ca06e3 e4be87e3a135e35eaa2086e5d6d34e723f3e7cb9 724c32c2a1c081f2b5f4a1e4bcd764a6
M20-n4o01Barys_bd0b4ba3Windows This strike sends a malware sample known as Barys. Barys is a trojan and downloader that will upload malicious files to the victim machine.bd0b4ba35f630a93ea4c96418bc4667chttps://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html 085a78af5d0146251a13bc743866fe4292d84a6c0753c6e6fcbb91d2c7826dfe 68c90ee857979104a58ada8458c3f298a7e58d8f bd0b4ba35f630a93ea4c96418bc4667c
M20-lko01Dridex_af0ef8ecWindows This strike sends a malware sample known as Dridex. Dridex is an online banking malware that steals personal information through HTML injections. It was first spotted at the end of 2014 and its inventors keep improving it periodically since then. The latest improvement is the addition of AtomBombing technique (does not exploit any vulnerabilities but uses a design falw in Windows related to system-level Atom Tables) which makes Dridex harder to detect by antiviruses.af0ef8ec129220425dd74d57b417a336https://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html 05afedd0b76f574373f858b854958c473482fcc6fa9736f0d447094605ad2102 9f685a85e927b77771bded0e20c0298f1460fea2 af0ef8ec129220425dd74d57b417a336
M20-xuu01Barys_77030cd6Windows This strike sends a malware sample known as Barys. Barys is a trojan and downloader that will upload malicious files to the victim machine.77030cd6ea7fcf42b0fb11d56291dce6https://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html 1962b11c5701a4b591c219a30164708e42bad73e72a58b5896cfa48c0ad20ed5 387ecc6a5455ae70e70f1277b31a1a2fb611195b 77030cd6ea7fcf42b0fb11d56291dce6
M20-f4601TeslaCrypt_0e4da722Windows This strike sends a malware sample known as TeslaCrypt. This sample is known as TeslaCrypt.0e4da7223137b4b79a7723534d5a8ea6https://blog.talosintelligence.com/2020/01/threat-roundup-0103-0110.html 4b7a8b7ffac89faa52034d12821a9e20bfd987adcdcbdba29d6daaca44ef9325 8e334590bbff6e984ddcbde1a8867ea35519d9cb 0e4da7223137b4b79a7723534d5a8ea6
M20-uai01ZeroAccess_1975e954Windows This strike sends a malware sample known as ZeroAccess. This sps:/e is known as ZeroAccess. ZeroAccess is a trojan that infects Windows systems, installing a rootkit to hide its presence on the affected machine and serves as a platform for conducting click-fraud campaigns.1975e9548e58255369add957a57872a5https://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html 024be6e3a83461f6084ade9ef26da705de0e7eeceebbd55ca5289a7396dcf280 767b915b00cfee96a3952aba5908234014d00b83 1975e9548e58255369add957a57872a5
M20-h0501ZeroAccess_d57b4083Windows This strike sends a malware sample known as ZeroAccess. This sample is known as ZeroAccess. ZeroAccess is a trojan that infects Windows systems, installing a rootkit to hide its presence on the affected machine and serves as a platform for conducting click-fraud campaigns.d57b40830d38d1e81519dbde3b07eae6https://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html 0808ec44505b3130a5dde6e81c75f473f44a288d1134fff680394534283fce87 252d1993b8c38a8ba0ecf7f6ab5d355f6eb4462c d57b40830d38d1e81519dbde3b07eae6
M20-3px01ZeroAccess_034d9170Windows This strike sends a malware sample known as ZeroAccess. This sample is known as ZeroAccess. ZeroAccess is a trojan that infects Windows systems, installing a rootkit to hide its presence on the affected machine and serves as a platform for conducting click-fraud campaigns.034d91706a1408eb72fada20f193d854https://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html 311c8b6b2d2150fff040363e23fdca221be64cae3ad34d9b3dfacd396ed48fc6 7fef9f3226964a453ac7ce7b945e4b1bc2b86d83 034d91706a1408eb72fada20f193d854
M20-gmq01Formbook_6a5779bdWindows This strike sends a malware sample known as Formbook. This malicious sample is known as Formbook. Formbook is an information stealer that attempts to collect sensitive information from the target.6a5779bd1c27ab3864ccf488a9e4ee6fhttps://blog.talosintelligence.com/2020/01/threat-roundup-0103-0110.html 046bebb1052d11ee3db2b5c8cbf3e2f1dd509a2aa73e53f4ffb18d39985165cf 907c4c695a093ecba41b0ecda7c06156481e0fc8 6a5779bd1c27ab3864ccf488a9e4ee6f
M20-5f801Formbook_c73e9143Windows This strike sends a malware sample known as Formbook. This malicious sample is known as Formbook. Formbook is an information stealer that attempts to collect sensitive information from the target.c73e91434d9bf737e989d4c0078f56cdhttps://blog.talosintelligence.com/2020/01/threat-roundup-0103-0110.html 1c64787e6ef766f7d9b8cc99deb128d45b89d02accacb3dac1e2ad076f5139eb babd162573f2847cc453d11cabace152dc91005b c73e91434d9bf737e989d4c0078f56cd
M20-86q01Barys_b4d08748Windows This strike sends a malware sample known as Barys. Barys is a trojan and downloader that will upload malicious files to the victim machine.b4d08748b2499e2f26773a61515e98dbhttps://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html 12bd605a3b68b17d0279e5fd34cb2c9dee540f4eb1b248447d101c9199ebfaf5 269f90a1f75d4d61a1ef15f8777343b603e7003d b4d08748b2499e2f26773a61515e98db
M20-0un01Formbook_7df0af4eWindows This strike sends a malware sample known as Formbook. This malicious sample is known as Formbook. Formbook is an information stealer that attempts to collect sensitive information from the target.7df0af4e01c350c308ccecc59ece50a8https://blog.talosintelligence.com/2020/01/threat-roundup-0103-0110.html 352c218b502f9db9eb8a56d8d6515c3fbe51298e29fe3878731a037885dc7f7b 6c28e1c3885c44583bcb29da073e739077a9707d 7df0af4e01c350c308ccecc59ece50a8
M20-wxf01Formbook_4bd1bf3bWindows This strike sends a malware sample known as Formbook. This malicious sample is known as Formbook. Formbook is an information stealer that attempts to collect sensitive information from the target.4bd1bf3b4c9ea31d051cb1ab57131587https://blog.talosintelligence.com/2020/01/threat-roundup-0103-0110.html 049fa135806899faa44ce50ba918331d0ea0aeb8aa6db5012117bfc794f57759 73c6ac0f65cb60aca17e6da4dce951ecf7039061 4bd1bf3b4c9ea31d051cb1ab57131587
M20-in101Barys_dbfaf1b2Windows This strike sends a malware sample known as Barys. Barys is a trojan and downloader that will upload malicious files to the victim machine.dbfaf1b2bdf3967c62888c754c9a0c32https://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html 0d638e32faab7502716a78610e97a4c55974ff1c648784aa66294f1e594cbe1f 361e66413c4f8ae00d68d0231fbd62fdb4a965c4 dbfaf1b2bdf3967c62888c754c9a0c32
M20-ujw01ZeroAccess_b43395ccWindows This strike sends a malware sample known as ZeroAccess. This sample is known as ZeroAccess. ZeroAccess is a trojan that infects Windows systems, installing a rootkit to hide its presence on the affected machine and serves as a platform for conducting click-fraud campaigns.b43395ccc16f04da25f66cc6b107d2f3https://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html 3fcf02116eab251a35b6a9dba981edb13ba59701f0b52ca1521fd2dbff350477 488017443a7d2fdfa58e68e5467cccc1bd2eb856 b43395ccc16f04da25f66cc6b107d2f3
M20-se801Formbook_93dbf029Windows This strike sends a malware sample known as Formbook. This malicious sample is known as Formbook. Formbook is an information stealer that attempts to collect sensitive information from the target.93dbf02991625c3ffc206d9e6c8f6958https://blog.talosintelligence.com/2020/01/threat-roundup-0103-0110.html 0d49120f2ce8cc77ea769c79a1ab5c7669cb58c07de1a95f08549d2665529df1 b588912660cb9f4f050f33fe0780af6339bd69dd 93dbf02991625c3ffc206d9e6c8f6958
M20-nrs01Formbook_72d0f14bWindows This strike sends a malware sample known as Formbook. This malicious sample is known as Formbook. Formbook is an information stealer that attempts to collect sensitive information from the target.72d0f14bee34bab60382fac69faf7aa3https://blog.talosintelligence.com/2020/01/threat-roundup-0103-0110.html 07387a7c05fcaf63b03673bd92d634fcd13e1784fb6adcc6c2b8cf7154c07e55 aec004f7915872eeabe9c492c75851f8cdd902dd 72d0f14bee34bab60382fac69faf7aa3
M20-dln01Barys_9ee7fa54Windows This strike sends a malware sample known as Barys. Barys is a trojan and downloader that will upload malicious files to the victim machine.9ee7fa54aff7dbc2dc00f28b5b8ef0a2https://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html 1a91bfeb723c4ad729eea5e22da6f8afeecbdb990a18c3272e1fc92d7c94bdae 6fa5d56434b90926f76b47ca27142d124b12fb7e 9ee7fa54aff7dbc2dc00f28b5b8ef0a2
M20-2g801Upatre_47c8e49dWindows This strike sends a malware sample known as Upatre. Upatre is a malicious downloader often used by exploit kits and phishing campaigns. Upatre downloads and executes malicious executables, such as banking malware.47c8e49dab4ff8d4ea29c04786caec98https://blog.talosintelligence.com/2020/01/threat-roundup-0103-0110.html 1356d0345699b8766d5c8de5d61cb47fd63dc3f42fe2280a2c413a8d7f97c1c8 c14bc3ca54650bb9180fd416234d88d859ca4585 47c8e49dab4ff8d4ea29c04786caec98
M20-mdb01Formbook_b0dc5376Windows This strike sends a malware sample known as Formbook. This malicious sample is known as Formbook. Formbook is an information stealer that attempts to collect sensitive information from the target.b0dc537653aeb5deb5edd6229daa50b5https://blog.talosintelligence.com/2020/01/threat-roundup-0103-0110.html 3064e41052d6dfa7c354a6e8c405ae2c1d09e48fa9e82dc4e8faee1f4bebdd4d ff32083997bd79481a59a3b34231d1f82aeb061b b0dc537653aeb5deb5edd6229daa50b5
M20-yuu01njRAT_e441a1b0Windows This strike sends a malware sample known as njRAT. This malicious sample known as njRAT is also known as Bladabindi. It is a remote access trojan (RAT) that allows attackers to execute commands on the infected host, log keystrokes and remotely turn on the victim's webcam and microphone. njRAT was developed by the Sparclyheason group. Some of the largest attacks using this malware date back to 2014.e441a1b043498a00695befb3a50b543chttps://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html 6b1bbec6381d6c95ef40d1ddb1ffbc015777d30686d9ba4353857f35b5947e15 4618fd7d731d43e51686229d67bfc129b52f5a75 e441a1b043498a00695befb3a50b543c
M20-bd501Upatre_612a51a9Windows This strike sends a malware sample known as Upatre. Upatre is a malicious downloader often used by exploit kits and phishing campaigns. Upatre downloads and executes malicious executables, such as banking malware.612a51a9f1910295d8c552fa7f5707dfhttps://blog.talosintelligence.com/2020/01/threat-roundup-0103-0110.html 0d774c5ac17521abec32a11e81317fed5f7c163d82ec7f9e1065c86834458cfe 917cab5814aaf8905879deb1c998f09a6ae605be 612a51a9f1910295d8c552fa7f5707df
M20-sj901Upatre_379231a9Windows This strike sends a malware sample known as Upatre. Upatre is a malicious downloader often used by exploit kits and phishing campaigns. Upatre downloads and executes malicious executables, such as banking malware.379231a949d4248fad481eb26c87caadhttps://blog.talosintelligence.com/2020/01/threat-roundup-0103-0110.html 09589d82d2f9460fe3d33b726794d41a93b672dbaed8e5f397350b7714649cd7 7fc15988bfb9e1722208a032d7475a9522c7a7d9 379231a949d4248fad481eb26c87caad
M20-q9t01Dridex_3dda795cWindows This strike sends a malware sample known as Dridex. Dridex is an online banking malware that steals personal information through HTML injections. It was first spotted at the end of 2014 and its inventors keep improving it periodically since then. The latest improvement is the addition of AtomBombing technique (does not exploit any vulnerabilities but uses a design falw in Windows related to system-level Atom Tables) which makes Dridex harder to detect by antiviruses.3dda795cc6b1974356d20e3c8b488793https://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html a31fdd57bc317cd8f6c4df0c6f75bcd25999d36f7cc665da9018672dfe55061c 31295d1f2545a6ebc0af06bb7717d21504965221 3dda795cc6b1974356d20e3c8b488793
M20-0zd01Barys_d8433aeaWindows This strike sends a malware sample known as Barys. Barys is a trojan and downloader that will upload malicious files to the victim machine.d8433aeab87778b6217373b077189ff7https://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html 0b0c9946d82dba06fceda4ce8a8f2a8ad828adba44e630f4652a5784d4305e5c d57aa6e8451c1426e66c7944452496c7a0f27fcc d8433aeab87778b6217373b077189ff7
M20-sv401njRAT_a55f7adaWindows This strike sends a malware sample known as njRAT. This malicious sample known as njRAT is also known as Bladabindi. It is a remote access trojan (RAT) that allows attackers to execute commands on the infected host, log keystrokes and remotely turn on the victim's webcam and microphone. njRAT was developed by the Sparclyheason group. Some of the largest attacks using this malware date back to 2014.a55f7adafd595f9934791d2a144e4e04https://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html 437d2adb9946aeb1e630619e4aa571149d2adedeea8f6d0c39c1bed21c4063cb 1e44dda9c80ff0adaf802968d38f9c71bf30af74 a55f7adafd595f9934791d2a144e4e04
M20-g8d01TeslaCrypt_b2fe6935Windows This strike sends a malware sample known as TeslaCrypt. This sample is known as TeslaCrypt.b2fe693567a6069695968fcf3f18e864https://blog.talosintelligence.com/2020/01/threat-roundup-0103-0110.html c7a8125f64e0c8d4133263f901855d1ef0ecea2e083c10782e4cfbbe8b334e79 f90b2a659adec366ed9a83148e8c7ca8197740da b2fe693567a6069695968fcf3f18e864
M20-dx201Upatre_2138435eWindows This strike sends a malware sample known as Upatre. Upatre is a malicious downloader often used by exploit kits and phishing campaigns. Upatre downloads and executes malicious executables, such as banking malware.2138435e428ae7e5b4bd8e44a98d886ehttps://blog.talosintelligence.com/2020/01/threat-roundup-0103-0110.html 02f4933753d850d1774b56cbd35c994b6b7dd9b971fd45c34f5677f90b281b6a d6c3cd9256a40044a54442fb1ef79118c2266962 2138435e428ae7e5b4bd8e44a98d886e
M20-7jw01Razy_3d501f55Windows This strike sends a malware sample known as Razy. This malicious sample is known as Razy. Razy is often used as a generic detection name for a Windows trojan.3d501f55839f87805e733dc99cf8a090https://blog.talosintelligence.com/2020/01/threat-roundup-0103-0110.html 51e97032af43de44947d564ee43a9b43278312873caaa4bbd7d3e4f7ec00eb89 6baa3a7541cf4f46d8fa12e8dfd5a893ea319dc2 3d501f55839f87805e733dc99cf8a090
M20-i4x01Razy_6035e0f5Windows This strike sends a malware sample known as Razy. This malicious sample is known as Razy. Razy is often used as a generic detection name for a Windows trojan.6035e0f59a5169e7c59129a3cdbd076ehttps://blog.talosintelligence.com/2020/01/threat-roundup-0103-0110.html 58962a9133651591f2d4df22589d1cdd4f7cee175f70c7d47c5a854a5264ec98 68cd40536b4de6ed8c8d15e11dd396082d04f665 6035e0f59a5169e7c59129a3cdbd076e
M20-2lk01Barys_49292baaWindows This strike sends a malware sample known as Barys. Barys is a trojan and downloader that will upload malicious files to the victim machine.49292baa0ec39575ab4cf2b4b63a0232https://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html 033645d3516e2f25ddb3566c1eed8a6be6d3c023f7f0e98c868efa12483dfac3 a8c74f592b693276ed2abc2d700207bfcc55f92a 49292baa0ec39575ab4cf2b4b63a0232
M20-8zk01Razy_182b3bc2Windows This strike sends a malware sample known as Razy. This malicious sample is known as Razy. Razy is often used as a generic detection name for a Windows trojan.182b3bc278d1fe14d3ccbcd3e6dedc71https://blog.talosintelligence.com/2020/01/threat-roundup-0103-0110.html 6dfdb201ddd46c8f2ded273f3c8ed6c5beca63196b5428fe388f59faaac79597 91b87f45ead7dfaf252cb39e56605004b9458a34 182b3bc278d1fe14d3ccbcd3e6dedc71
M20-a6m01njRAT_d4c0d088Windows This strike sends a malware sample known as njRAT. This malicious sample known as njRAT is also known as Bladabindi. It is a remote access trojan (RAT) that allows attackers to execute commands on the infected host, log keystrokes and remotely turn on the victim's webcam and microphone. njRAT was developed by the Sparclyheason group. Some of the largest attacks using this malware date back to 2014.d4c0d088185543391cc814683626a095https://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html 3d8b6537791fe4f05043a40cc0cff83fb5ae54396c40fded6daae018a7a03c0e 592ea13a1b8ba20e71564cef1597e92b8700f4c4 d4c0d088185543391cc814683626a095
M20-xm001Dridex_ed369da6Windows This strike sends a malware sample known as Dridex. Dridex is an online banking malware that steals personal information through HTML injections. It was first spotted at the end of 2014 and its inventors keep improving it periodically since then. The latest improvement is the addition of AtomBombing technique (does not exploit any vulnerabilities but uses a design falw in Windows related to system-level Atom Tables) which makes Dridex harder to detect by antiviruses.ed369da6bfa27c6bc72fc7a22b98ea01https://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html 0a4e162d4a11aa91ead63995af22c410b422b8b5af2038d4ef95d454c1d380e1 059853b89af8c5fb9b497406ba6d502d06301726 ed369da6bfa27c6bc72fc7a22b98ea01
M20-d8n01Upatre_fad90a0fWindows This strike sends a malware sample known as Upatre. Upatre is a malicious downloader often used by exploit kits and phishing campaigns. Upatre downloads and executes malicious executables, such as banking malware.fad90a0fe7f3b2c11722157e7c11f710https://blog.talosintelligence.com/2020/01/threat-roundup-0103-0110.html 14e727de9a56e79b9dcaf48cc9751d4cb447f16d839d705c628640857d0e6e13 9129c8e5107c7e2d1a2e4d30eeb1ac7d8e80d881 fad90a0fe7f3b2c11722157e7c11f710
M20-82301Barys_ee52d2daWindows This strike sends a malware sample known as Barys. Barys is a trojan and downloader that will upload malicious files to the victim machine.ee52d2dabb2dc5bf716cdc6a2a93b936https://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html 18a5f4a28bd04a9e6b7283aa80bfe4649e48cac3592f72fed511e10935c80678 d49579191645d1c7cb32c95bd5ac0bf5e9264856 ee52d2dabb2dc5bf716cdc6a2a93b936
M20-fw601njRAT_f5390f1dWindows This strike sends a malware sample known as njRAT. This malicious sample known as njRAT is also known as Bladabindi. It is a remote access trojan (RAT) that allows attackers to execute commands on the infected host, log keystrokes and remotely turn on the victim's webcam and microphone. njRAT was developed by the Sparclyheason group. Some of the largest attacks using this malware date back to 2014.f5390f1d1907361d014ff3dbe5fce897https://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html 51e865bd11fd5daff52c74c0072c6e713535d4a90d5b1398b78c806be1a59dc9 e63e45adaf4cadc7c49e71eb67090bae3ba3a56e f5390f1d1907361d014ff3dbe5fce897
M20-ynl01ZeroAccess_b3d5d41bWindows This strike sends a malware sample known as ZeroAccess. This sample is known as ZeroAccess. ZeroAccess is a trojan that infects Windows systems, installing a rootkit to hide its presence on the affected machine and serves as a platform for conducting click-fraud campaigns.b3d5d41bf2becdec3db1d0c8d33547ebhttps://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html 243ccb0ec0007367fc4e21dea982be68d6f32e6cdcafbd11e10768cb912a914b 282c2a9a8fdfe50ff5906889cf16cf169b5260b1 b3d5d41bf2becdec3db1d0c8d33547eb
M20-2lp01Upatre_3cfd2d2fWindows This strike sends a malware sample known as Upatre. Upatre is a malicious downloader often used by exploit kits and phishing campaigns. Upatre downloads and executes malicious executables, such as banking malware.3cfd2d2fdb4472a0a224c287e4f1f4ffhttps://blog.talosintelligence.com/2020/01/threat-roundup-0103-0110.html 0e36b813e84b27ff1c1b770fffbf4175c7c39bbe499804c9c27565ed4a9518fa 3c10c776b79c7129126b2099c375fdb072d13b79 3cfd2d2fdb4472a0a224c287e4f1f4ff
M20-bpk01Formbook_35c3de31Windows This strike sends a malware sample known as Formbook. This malicious sample is known as Formbook. Formbook is an information stealer that attempts to collect sensitive information from the target.35c3de3155ced457f3fc826d7fb0d28chttps://blog.talosintelligence.com/2020/01/threat-roundup-0103-0110.html 0d8e415c487a6ced2680bcb31834fe282b914f09ac167dfb4f1685af0b529c35 bd1a26bb487c32fce32fefe2642edd4f6566a670 35c3de3155ced457f3fc826d7fb0d28c
M20-id001ZeroAccess_83ec7544Windows This strike sends a malware sample known as ZeroAccess. This sample is known as ZeroAccess. ZeroAccess is a trojan that infects Windows systems, installing a rootkit to hide its presence on the affected machine and serves as a platform for conducting click-fraud campaigns.83ec7544adff994dc675c8f704e56d28https://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html 3b3d6c01a983c835152e169e092be6193bce78c22b41cda5e573e5330235aac6 be3fc65d7c78cb5c933fafcf2c87e95ad7b2e5c2 83ec7544adff994dc675c8f704e56d28
M20-6q201Barys_48b3a295Windows This strike sends a malware sample known as Barys. Barys is a trojan and downloader that will upload malicious files to the victim machine.48b3a295e97ee603019679babf450344https://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html 1493472fd451f1109f5c245245469e6882f92d34610a6c468e3af5dd9acdac89 874de7fe244a11482bc6ea595daae763ed0a8603 48b3a295e97ee603019679babf450344
M20-afb01Upatre_2eed3e2bWindows This strike sends a malware sample known as Upatre. Upatre is a malicious downloader often used by exploit kits and phishing campaigns. Upatre downloads and executes malicious executables, such as banking malware.2eed3e2bd00ceee1a3b84ce8f0f5ed74https://blog.talosintelligence.com/2020/01/threat-roundup-0103-0110.html 0c45c58eab16df4d5bff14dad957f91d5785a09836560bc3bd681c27e012b1b8 3a2ffab8d97d4c153a30ef99b623c7a66e102fd5 2eed3e2bd00ceee1a3b84ce8f0f5ed74
M20-6le01ZeroAccess_f95def2aWindows This strike sends a malware sample known as ZeroAccess. This sample is known as ZeroAccess. ZeroAccess is a trojan that infects Windows systems, installing a rootkit to hide its presence on the affected machine and serves as a platform for conducting click-fraud campaigns.f95def2a7f3a66f02da3551ff3338c8bhttps://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html 39bf409ea1d861dfed811fa6c0aee2767aff44d96fffb4f3e552db1add1ed7fc 7f58ba975d2c21fb702c38f305c23a018776ec6f f95def2a7f3a66f02da3551ff3338c8b
M20-xtg01ZeroAccess_cd160a9bWindows This strike sends a malware sample known as ZeroAccess. This sample is known as ZeroAccess. ZeroAccess is a trojan that infects Windows systems, installing a rootkit to hide its presence on the affected machine and serves as a platform for conducting click-fraud campaigns.cd160a9bd9c1ea683ccdb0b66f7e6807https://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html 35ba7b85dd5146c275b74b7b09ef62985ba9db0d1e1f2771b6990d53ed965d52 e6614efbb503dc59b96276419c0d4e713a1cf123 cd160a9bd9c1ea683ccdb0b66f7e6807
M20-ful01Upatre_aca201b7Windows This strike sends a malware sample known as Upatre. Upatre is a malicious downloader often used by exploit kits and phishing campaigns. Upatre downloads and executes malicious executables, such as banking malware.aca201b7fc48f2a76469aa0a43931fc6https://blog.talosintelligence.com/2020/01/threat-roundup-0103-0110.html 0fa25c7c007f337ab5ba699a2611c47ff41a8ba74cb83fa1ffde097e7408f8ed 8dd4a19be454a6a149fad6c0115e0f7a14d21742 aca201b7fc48f2a76469aa0a43931fc6
M20-hl301Formbook_68bd4545Windows This strike sends a malware sample known as Formbook. This malicious sample is known as Formbook. Formbook is an information stealer that attempts to collect sensitive information from the target.68bd45451832c99eea39db4d2556336dhttps://blog.talosintelligence.com/2020/01/threat-roundup-0103-0110.html 208a5ebc7af4b8d15e157e9115f4617a2b3e021a868367b3e7bb0bde69170911 a3b5b33cf3b4ca16321a2073594167a878331747 68bd45451832c99eea39db4d2556336d
M20-gjz01JhoneRATImage_bdd38fdcMixed This strike sends a malware sample known as JhoneRATImage. This malicious sample is known as JhoneRAT. JhoneRAT is Remote Access Trojan developed in Python that is delivered by means of an office document, and then delivers payloads via multiple layers hosted by Cloud based providers in order to avoid blacklisting. This sample is the image delivered by the JhoneRAT template. At the end of the image is base64 text that when decoded points to an AutoIT binary for download.bdd38fdc1c057ccfa416abafa46f0e84https://blog.talosintelligence.com/2020/01/jhonerat.html 7e1121fca3ac7c2a447b61cda997f3a8202a36bf9bb08cca3402df95debafa69 6ac3fd0b6984cd05ca2a0062a7be2f4e49d5c19d bdd38fdc1c057ccfa416abafa46f0e84
M20-x6o01Razy_b4f3aea9Windows This strike sends a malware sample known as Razy. This malicious sample is known as Razy. Razy is often used as a generic detection name for a Windows trojan.b4f3aea9f95879abbe9b311b5ab9fc30https://blog.talosintelligence.com/2020/01/threat-roundup-0103-0110.html 6bd1baae5ba600ff4ece4523e53bf9818bcc381a56664e3104c1c317d6f5a3bc aaa5da052dac9e82ac4ff5c9510fb26945768a8e b4f3aea9f95879abbe9b311b5ab9fc30
M20-ymm01JhoneRATDownloader_7c487d84Mixed This strike sends a malware sample known as JhoneRATDownloader. This malicious sample is known as JhoneRAT. JhoneRAT is Remote Access Trojan developed in Python that is delivered by means of an office document, and then delivers payloads via multiple layers hosted by Cloud based providers in order to avoid blacklisting. This sample of JhoneRAT act as the initial downloaders and download an additional malicious document with a macro.7c487d8462567a826da95c799591f5fbhttps://blog.talosintelligence.com/2020/01/jhonerat.html 29886dbbe81ead9e9999281e62ecf95d07acb24b9b0906b28beb65a84e894091 7551f49c26c17ad60e97112cbad4a97ab130545f 7c487d8462567a826da95c799591f5fb
M20-hyp01Upatre_26f9554eWindows This strike sends a malware sample known as Upatre. Upatre is a malicious downloader often used by exploit kits and phishing campaigns. Upatre downloads and executes malicious executables, such as banking malware.26f9554e80245118220e906ebcfda002https://blog.talosintelligence.com/2020/01/threat-roundup-0103-0110.html 14178c54d283e6579242e90df7c4dae8af71ff4594c834e3cc7a275588f561b7 f38d64ca6ceda338a5abc80d69b2c041557c1907 26f9554e80245118220e906ebcfda002
M20-sy701Upatre_8685ad47Windows This strike sends a malware sample known as Upatre. Upatre is a malicious downloader often used by exploit kits and phishing campaigns. Upatre downloads and executes malicious executables, such as banking malware.8685ad471cfa9b9964511205549f2336https://blog.talosintelligence.com/2020/01/threat-roundup-0103-0110.html 1e1bdd6ddb3c256c79024eccdb2de6b0861a2a86e13f3f03cf1f378e2cdc9d36 a08574764d8dc7ee101a8fa0915e21ce647b5449 8685ad471cfa9b9964511205549f2336
M20-7uh01Upatre_75be6cafWindows This strike sends a malware sample known as Upatre. Upatre is a malicious downloader often used by exploit kits and phishing campaigns. Upatre downloads and executes malicious executables, such as banking malware.75be6caf089b40f3b9e9b82204ba384chttps://blog.talosintelligence.com/2020/01/threat-roundup-0103-0110.html 1535d470effa0af601719b9ef64e615f321e4db52ee4b7bb05def6d501884fbc 345e693aeaa6061fdd19f8119ab74055d22a7719 75be6caf089b40f3b9e9b82204ba384c
M20-40601ZeroAccess_1a7b93dfWindows This strike sends a malware sample known as ZeroAccess. This sample is known as ZeroAccess. ZeroAccess is a trojan that infects Windows systems, installing a rootkit to hide its presence on the affected machine and serves as a platform for conducting click-fraud campaigns.1a7b93dfa5542aeb2e7259781f610b45https://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html 0712314c985a7cc479d0cbcdcf06c886ba2d7fc79d89cf4efc56a137235eb379 f8dbe847bbc099c769288c59e25c162c1e01a3e8 1a7b93dfa5542aeb2e7259781f610b45
M20-vil01njRAT_51dd20b6Windows This strike sends a malware sample known as njRAT. This malicious sample known as njRAT is also known as Bladabindi. It is a remote access trojan (RAT) that allows attackers to execute commands on the infected host, log keystrokes and remotely turn on the victim's webcam and microphone. njRAT was developed by the Sparclyheason group. Some of the largest attacks using this malware date back to 2014.51dd20b62e78c6abd74701879ea7a73ehttps://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html 2b140d53ec1d99cc07662d85f14bae2a4e6cfea3b7d66da0b31be4ecd641bae1 1675a38b7c3a17b0c9393a05292a21255972fa3f 51dd20b62e78c6abd74701879ea7a73e
M20-fde01njRAT_587a1b19Windows This strike sends a malware sample known as njRAT. This malicious sample known as njRAT is also known as Bladabindi. It is a remote access trojan (RAT) that allows attackers to execute commands on the infected host, log keystrokes and remotely turn on the victim's webcam and microphone. njRAT was developed by the Sparclyheason group. Some of the largest attacks using this malware date back to 2014.587a1b19bce19d4c8744e1b445da8356https://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html 459304f70aa2e992bdaed0915ec96cda9c99c6edde30698197319f8fa40a4024 79e23bd6e4ef957b5a99faf76bd4ffe7654eb330 587a1b19bce19d4c8744e1b445da8356
M20-evh01Barys_d0b0316bWindows This strike sends a malware sample known as Barys. Barys is a trojan and downloader that will upload malicious files to the victim machine.d0b0316b2347cdef7acc20e50f85c069https://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html 0de13ccba02abce52ee48511d094b474fbf8807aa54ea316f86a83befe85a1b6 608b4758b3b041d679cc11e5dee990d003bcdf2a d0b0316b2347cdef7acc20e50f85c069
M20-4hp01Barys_489b345eWindows This strike sends a malware sample known as Barys. Barys is a trojan and downloader that will upload malicious files to the victim machine.489b345e33ee86edf742c17ae72c6f5ahttps://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html 04ce16123c1db27009dfd8a2546810c881a22b6eeed4697d64cb44af2e69e75d b9810168e40d6c8469469a1dfcefd0af38db168b 489b345e33ee86edf742c17ae72c6f5a
M20-njs01Barys_5b7ccd86Windows This strike sends a malware sample known as Barys. Barys is a trojan and downloader that will upload malicious files to the victim machine.5b7ccd8600e61e379f9c6b84ab180d4chttps://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html 0c85f4b989930dd44f791828bad61061e8ff325142e1dd275fa30295a343c051 fa8672fc75d9869afddb8319a6ffa7761cd80d3e 5b7ccd8600e61e379f9c6b84ab180d4c
M20-ue901Dridex_d8426813Windows This strike sends a malware sample known as Dridex. Dridex is an online banking malware that steals personal information through HTML injections. It was first spotted at the end of 2014 and its inventors keep improving it periodically since then. The latest improvement is the addition of AtomBombing technique (does not exploit any vulnerabilities but uses a design falw in Windows related to system-level Atom Tables) which makes Dridex harder to detect by antiviruses.d84268130427e184fe56de6fa9a3a437https://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html b5d15bb5d2a6bde41040d4b9d63e8cc1cfddf8669f5c1389c2aba584328dc27b 646650e1f1e2c44983ccef74909ebc65fea1f6a9 d84268130427e184fe56de6fa9a3a437
M20-96701Formbook_27a68126Windows This strike sends a malware sample known as Formbook. This malicious sample is known as Formbook. Formbook is an information stealer that attempts to collect sensitive information from the target.27a6812638d9959aacf671def4dfb6adhttps://blog.talosintelligence.com/2020/01/threat-roundup-0103-0110.html 0de2930e0fd1d971aa98b219ce6dc3f36b07d8441b7abd0d663a63dd77cfbf37 234a66514aa6c756a60b9fb28767513452915dc4 27a6812638d9959aacf671def4dfb6ad
M20-syb01Upatre_cbddbbd1Windows This strike sends a malware sample known as Upatre. Upatre is a malicious downloader often used by exploit kits and phishing campaigns. Upatre downloads and executes malicious executables, such as banking malware.cbddbbd143ed17e672979558bb38fdabhttps://blog.talosintelligence.com/2020/01/threat-roundup-0103-0110.html 10c863059e4910501e1deea44279a5402e93796098230511c65be09f8f47eb82 6e641fc5e5c39bc334539b0e46ba32bc9bb3e4d5 cbddbbd143ed17e672979558bb38fdab
M20-xl501JhoneRATDownloader_089531d7Mixed This strike sends a malware sample known as JhoneRATDownloader. This malicious sample is known as JhoneRAT. JhoneRAT is Remote Access Trojan developed in Python that is delivered by means of an office document, and then delivers payloads via multiple layers hosted by Cloud based providers in order to avoid blacklisting. This sample of JhoneRAT act as the initial downloaders and download an additional malicious document with a macro.089531d78aad6a897c041e7270feea2bhttps://blog.talosintelligence.com/2020/01/jhonerat.html d5f10a0b5c103100a3e74aa9014032c47aa8973b564b3ab03ae817744e74d079 c33930f7f38f7ece2cad3a4cb11308c07e47eeb1 089531d78aad6a897c041e7270feea2b
M20-3vb01Barys_58f6454dWindows This strike sends a malware sample known as Barys. Barys is a trojan and downloader that will upload malicious files to the victim machine.58f6454d44f726d96b691c1e6bbc0f67https://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html 1888096d2e773f3e1377ee329bf649d0032e384badd451731cc1f6cf7eb924ce 69384008c9418c5a71539208844545b4dde7718f 58f6454d44f726d96b691c1e6bbc0f67
M20-nnu01Barys_7bc6ed6dWindows This strike sends a malware sample known as Barys. Barys is a trojan and downloader that will upload malicious files to the victim machine.7bc6ed6d3a9eb473dfe362beb419cfc9https://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html 08d8cf4bd5635a6930758f7736259f230ff559ede4880d044aa4eaed47f37115 7f91ad49bd25c7ffa9612d8c2eb2cdbe68ed92d9 7bc6ed6d3a9eb473dfe362beb419cfc9
M20-90l01ZeroAccess_a062216aWindows This strike sends a malware sample known as ZeroAccess. This sample is known as ZeroAccess. ZeroAccess is a trojan that infects Windows systems, installing a rootkit to hide its presence on the affected machine and serves as a platform for conducting click-fraud campaigns.a062216acf6bbcc7dbc83adeb6752c33https://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html 1744dd32bcf9cd45cfec1f4334de1df340129a555e12f73c740e02f7fe7b469c 6b20df3b6b2aad932ba2525cd47b47aa2c0878f6 a062216acf6bbcc7dbc83adeb6752c33
M20-byg01TeslaCrypt_f65aeb05Windows This strike sends a malware sample known as TeslaCrypt. This sample is known as TeslaCrypt.f65aeb05e5ca5ebe1ae05cbe72aa71e0https://blog.talosintelligence.com/2020/01/threat-roundup-0103-0110.html b8dd6020265dc28fa74d1708e2238cc227791dace690699db22cbb3ba6c1d64c e27c6667e01e243534ec922242864642ace1cfa6 f65aeb05e5ca5ebe1ae05cbe72aa71e0
M20-oel01Razy_0786b90dWindows This strike sends a malware sample known as Razy. This malicious sample is known as Razy. Razy is often used as a generic detection name for a Windows trojan.0786b90da12b29b5cc97621dcc78fa3ehttps://blog.talosintelligence.com/2020/01/threat-roundup-0103-0110.html 8fa302841d886e0198c96d76d93399f5905844f424b255e6707a74ea610c55ce d3292e136139b0215f5a2e03af2518365344c668 0786b90da12b29b5cc97621dcc78fa3e
M20-4fj01ZeroAccess_30def6e2Windows This strike sends a malware sample known as ZeroAccess. This sample is known as ZeroAccess. ZeroAccess is a trojan that infects Windows systems, installing a rootkit to hide its presence on the affected machine and serves as a platform for conducting click-fraud campaigns.30def6e242a9d2fc2ffbf811814b99b6https://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html 0d6aea5357e88970db6f5c226a2a888e1c7f1c5f20146087952612c06d064b4e bcf7d7538e94cf9940c19af648a1cb48ef80e604 30def6e242a9d2fc2ffbf811814b99b6
M20-5mk01Formbook_1e9eef27Windows This strike sends a malware sample known as Formbook. This malicious sample is known as Formbook. Formbook is an information stealer that attempts to collect sensitive information from the target.1e9eef2736663a184d8630a0cab97050https://blog.talosintelligence.com/2020/01/threat-roundup-0103-0110.html 30545b09c38a284d95310d71822427e0bc0b69dcaeb3d316f2fe39decfb8c006 459cb8b32a43b34ac530d6a599517d05dd4ac76a 1e9eef2736663a184d8630a0cab97050
M20-bty01Barys_63887daaWindows This strike sends a malware sample known as Barys. Barys is a trojan and downloader that will upload malicious files to the victim machine.63887daa5ffeff3045af57a201125b10https://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html 13c397c69dd1c2357af059f5760a551567834c836b6d124e4e1ffee085feda80 4e30686b39e234778c360bd349a323e5ad86b9c8 63887daa5ffeff3045af57a201125b10
M20-t5401Barys_5eee0ae3Windows This strike sends a malware sample known as Barys. Barys is a trojan and downloader that will upload malicious files to the victim machine.5eee0ae3dc30f2fd1f10c18a2855ca9ehttps://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html 12f1c270b4df8c8baa2eb194f85267da965450cf35696644d71d3835a3905e1b e918fa91c2b6d56c68b171c73bed3f82e9bb7f44 5eee0ae3dc30f2fd1f10c18a2855ca9e
M20-jje01njRAT_a2e18416Windows This strike sends a malware sample known as njRAT. This malicious sample known as njRAT is also known as Bladabindi. It is a remote access trojan (RAT) that allows attackers to execute commands on the infected host, log keystrokes and remotely turn on the victim's webcam and microphone. njRAT was developed by the Sparclyheason group. Some of the largest attacks using this malware date back to 2014.a2e18416057d40ed303fe2d41db5d4achttps://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html 275e4d554f63db96a64bbca5f0b30ab96199c8595ea0c3c2d46a413f30387a2f 548d19e13d072edcaa1b8b7431a0f62095dbfb3a a2e18416057d40ed303fe2d41db5d4ac
M20-t8m01Upatre_88e655feWindows This strike sends a malware sample known as Upatre. Upatre is a malicious downloader often used by exploit kits and phishing campaigns. Upatre downloads and executes malicious executables, such as banking malware.88e655fe971f7b011ab295366572358chttps://blog.talosintelligence.com/2020/01/threat-roundup-0103-0110.html 211bdc6613fc3e691ac70d215a8a9edd5f0ebb85bb4f24d6e293fb21894a0b1b fc49a8d3b9e4451792ab3aa0b130680c7d233728 88e655fe971f7b011ab295366572358c
M20-qyy01ZeroAccess_6041bac8Windows This strike sends a malware sample known as ZeroAccess. This sample is known as ZeroAccess. ZeroAccess is a trojan that infects Windows systems, installing a rootkit to hide its presence on the affected machine and serves as a platform for conducting click-fraud campaigns.6041bac827beff917de67c052fa449dchttps://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html 1d34f5231571a20d3229e850bb786f6148dab477ca4a0169a0af3acf2d2ce71d e024e214591687e01dea389369fa96c0d4a69312 6041bac827beff917de67c052fa449dc
M20-xdy01ZeroAccess_786f0783Windows This strike sends a malware sample known as ZeroAccess. This sample is known as ZeroAccess. ZeroAccess is a trojan that infects Windows systems, installing a rootkit to hide its presence on the affected machine and serves as a platform for conducting click-fraud campaigns.786f07836de13e3ea12e1e2b9a80dbe2https://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html 08b18f2eb8b1fb422adfb52d482f9d9bb3f4a24d18f89a186ed2865181f6b551 e2689f92665a7b5956d7559917375698e65fea1c 786f07836de13e3ea12e1e2b9a80dbe2
M20-6lz01Upatre_a070d768Windows This strike sends a malware sample known as Upatre. Upatre is a malicious downloader often used by exploit kits and phishing campaigns. Upatre downloads and executes malicious executables, such as banking malware.a070d768f5037eef476e143a5c93802ehttps://blog.talosintelligence.com/2020/01/threat-roundup-0103-0110.html 01cb3cbad05c3b0b186b604f32cb00a3ceced74ead26affe5b4fb1867d48be01 c960db6d3b95417d1a685a5364da5101cd246865 a070d768f5037eef476e143a5c93802e
M20-9wb01Formbook_c69adbf3Windows This strike sends a malware sample known as Formbook. This malicious sample is known as Formbook. Formbook is an information stealer that attempts to collect sensitive information from the target.c69adbf32676d5c28de54dd7abaef90ahttps://blog.talosintelligence.com/2020/01/threat-roundup-0103-0110.html 0da9443c8aacb9e4757b81deeaeedc7b96766020522ed9992d7b9ce3e0eb5130 ea55d5f751c9459abfdf76752078d66c9c4a32a6 c69adbf32676d5c28de54dd7abaef90a
M20-g0k01Barys_5b6ed716Windows This strike sends a malware sample known as Barys. Barys is a trojan and downloader that will upload malicious files to the victim machine.5b6ed716f254c816bb563ac063142757https://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html 17b64ea8a52fce27bcd439a2762f6a8dff4235c10ca99a60722e481509e42b0b 110e2ed3c11b0517a11afe195f07b14454c5cdaf 5b6ed716f254c816bb563ac063142757
M20-9ox01Formbook_b731e1f6Windows This strike sends a malware sample known as Formbook. This malicious sample is known as Formbook. Formbook is an information stealer that attempts to collect sensitive information from the target.b731e1f60594b3fe672cd7304d21ff1ehttps://blog.talosintelligence.com/2020/01/threat-roundup-0103-0110.html 3a14a285394c39842beaf312d02de42ab02c679e47cb6a40c3b900f196ba4e2d 9a1d0d20bad7cb8e1d516f389dc4421ba07cc4c5 b731e1f60594b3fe672cd7304d21ff1e
M20-yb401njRAT_962cee7bWindows This strike sends a malware sample known as njRAT. This malicious sample known as njRAT is also known as Bladabindi. It is a remote access trojan (RAT) that allows attackers to execute commands on the infected host, log keystrokes and remotely turn on the victim's webcam and microphone. njRAT was developed by the Sparclyheason group. Some of the largest attacks using this malware date back to 2014.962cee7b4a16f6b1d337183503ffeef5https://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html 0b331c29e38da9fe5fe00f40e2af43a4ac960ce48539b34e6d506c3b54a49920 fd85e8e00cc4651a84392d8768d0ef1bcab92ac1 962cee7b4a16f6b1d337183503ffeef5
M20-vvu01Barys_b35b224fWindows This strike sends a malware sample known as Barys. Barys is a trojan and downloader that will upload malicious files to the victim machine.b35b224fcb096f258f93d2481e67d30ehttps://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html 022d2461933a4aafe67d8ddb3c5fd7f14eea9035dec79bea200ff1d57776762d 7042ab77f4f378be5e7473ff2954851554f48f90 b35b224fcb096f258f93d2481e67d30e
M20-omy01njRAT_73069b4dWindows This strike sends a malware sample known as njRAT. This malicious sample known as njRAT is also known as Bladabindi. It is a remote access trojan (RAT) that allows attackers to execute commands on the infected host, log keystrokes and remotely turn on the victim's webcam and microphone. njRAT was developed by the Sparclyheason group. Some of the largest attacks using this malware date back to 2014.73069b4d1754bb2f506bb764811ac24ehttps://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html 339e7b601f00ee4b80af2645e1e39a8b71901d328d1c56e4f42e7ba74f16b618 87a23817db61f44c74ddf05ca62602e06f19993e 73069b4d1754bb2f506bb764811ac24e
M20-wx301Formbook_1ed222f7Windows This strike sends a malware sample known as Formbook. This malicious sample is known as Formbook. Formbook is an information stealer that attempts to collect sensitive information from the target.1ed222f75857455ac9e9da200d11bf2fhttps://blog.talosintelligence.com/2020/01/threat-roundup-0103-0110.html 163d07cf0a756800c6ce5be998331fdffa75081f5f669bbb6149eb0e89744043 839777c2097a8a8b11bd2454b530d222b140c282 1ed222f75857455ac9e9da200d11bf2f
M20-oyz01JhoneRATDownloader_4ae4e0f8Mixed This strike sends a malware sample known as JhoneRATDownloader. This malicious sample is known as JhoneRAT. JhoneRAT is Remote Access Trojan developed in Python that is delivered by means of an office document, and then delivers payloads via multiple layers hosted by Cloud based providers in order to avoid blacklisting. This sample of JhoneRAT act as the initial downloaders and download an additional malicious document with a macro.4ae4e0f8747a27f41e444fbc047f0191https://blog.talosintelligence.com/2020/01/jhonerat.html 273aa20c4857d98cfa51ae52a1c21bf871c0f9cd0bf55d5e58caba5d1829846f a1b70f143cb91d8ad16ab2ebb109517632e36ce6 4ae4e0f8747a27f41e444fbc047f0191
M20-wn001Barys_32b7468dWindows This strike sends a malware sample known as Barys. Barys is a trojan and downloader that will upload malicious files to the victim machine.32b7468d1c997710e2d2fd817e0ad000https://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html 1081f90d1fa09214611b5e0255d714db254f502e945069e93973eb0f63d00208 84717419b0caceeddeb7cadca657460b7670c829 32b7468d1c997710e2d2fd817e0ad000
M20-k9p01TeslaCrypt_9f890565Windows This strike sends a malware sample known as TeslaCrypt. This sample is known as TeslaCrypt.9f89056503e143e4a86f35acdafb1260https://blog.talosintelligence.com/2020/01/threat-roundup-0103-0110.html bd9a8d8d2c8e1d426959e7022ecd26b7001998aba2617e13deac573d16208916 fb8cb99ebb2aea4102618e834af95491f83e6152 9f89056503e143e4a86f35acdafb1260
M20-9pp01njRAT_fb2ba426Windows This strike sends a malware sample known as njRAT. This malicious sample known as njRAT is also known as Bladabindi. It is a remote access trojan (RAT) that allows attackers to execute commands on the infected host, log keystrokes and remotely turn on the victim's webcam and microphone. njRAT was developed by the Sparclyheason group. Some of the largest attacks using this malware date back to 2014.fb2ba426a42ad18bd8b37ea7dd80c745https://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html 21f09de33d10673fb5f8c2f1cf5924f5b81019e037a44b7f151da61b84c85b0d d0fffa6d64c1d60a4c2370c2a82b4b814dd60a8c fb2ba426a42ad18bd8b37ea7dd80c745
M20-gph01Barys_79924900Windows This strike sends a malware sample known as Barys. Barys is a trojan and downloader that will upload malicious files to the victim machine.799249006df902fdc067bd8370bcf629https://blog.talosintelligence.com/2020/01/threat-roundup-0110-0117.html 02de146284642091fd6104b2a09a0a5ffc92d51c28e8c492acecbd39fb0c30e0 f5e62bca41224df96f43468b3e4fcc02497aa540 799249006df902fdc067bd8370bcf629
M20-xjt01TeslaCrypt_25a649d5Windows This strike sends a malware sample known as TeslaCrypt. This sample is known as TeslaCrypt.25a649d54fe2a989f776bbc3c55ffd1dhttps://blog.talosintelligence.com/2020/01/threat-roundup-0103-0110.html 69a0539a87e7a9fe382cf4c504c3d02bf6ee4cd6a5e20098ed619da8975480ee 9c10553acb2ffd43bdda94b9efc4ee8631a8eea4 25a649d54fe2a989f776bbc3c55ffd1d