Antimalware research for IT pros and enthusiasts – Page 5

MSRT August 2016 release adds Neobar detection

January 23, 2017 admin Antimalware research for IT pros and enthusiasts, browser modifier, browser modifier objective criteria violation, BrowserModifier:Win32/Neobar, Microsoft Malicious Software Removal Tool, MSRT, Neobar, Objective Criteria, SoftwareBundler:Win32/Dlboost, SoftwareBundler:Win32/InstallMonster, Unwanted software

As part of our ongoing effort to provide better malware protection, the August 2016 release of the Microsoft Malicious Software Removal Tool (MSRT) includes detections for BrowserModifier: Win32/Neobar, unwanted software, and Win32/Rovnix, a trojan malware family. This blog discusses BrowserModifier:Win32/Neobar and its inclusion in MSRT supports our unwanted software family detections in Windows Defender, along…

Microsoft Security

MSRT July 2016 – Cerber ransomware

January 23, 2017 admin Antimalware research for IT pros and enthusiasts, Cerber, Cerber infection chain, Exxroute, Locky, Microsoft Malicious Software Removal Tool, MSRT, ransomware, ransomware detection, ransomware mitigation, ransomware recovery

As part of our ongoing effort to provide better malware protection, the July 2016 release of the Microsoft Malicious Software Removal Tool (MSRT) includes detection for Win32/Cerber, a prevalent ransomware family. The inclusion in MSRT complements our Cerber-specific family detections in Windows Defender, and our ransomware-dedicated cloud protection features. We started seeing Cerber in February…

Microsoft Security

Troldesh ransomware influenced by (the) Da Vinci code

January 23, 2017 admin Antimalware research for IT pros and enthusiasts, MMPC, ransomware, ransomware backup and recovery, ransomware da vinci code, ransomware mitigation, ransomware prevention, ransomware recovery, Trojan:Win32/Mexar.A, Win32/Troldesh, Windows 10, Windows update

We at the MMPC are constantly tracking new and emerging ransomware threats so we can be one step ahead of active campaigns and help protect our users. As part of these efforts, we recently came across a new variant of the Win32/Troldesh ransomware family. Ransomware, like most malware, is constantly trying to change itself in…

Microsoft Security

Reverse engineering DUBNIUM –Stage 2 payload analysis

January 23, 2017 admin Advanced Persistent Threat, Advanced persistent threats, Antimalware research for IT pros and enthusiasts, DUBNIUM APT, DUBNIUM infection chain, DUBNIUM payload, Microsoft Threat Intelligence

Recently, we blogged about the basic functionality and features of the DUBNIUM advanced persistent threat (APT) activity group Stage 1 binary and Adobe Flash exploit used during the December 2015 incident (Part 1, Part 2). In this blog, we will go through the overall infection chain structure and the Stage 2 executable details. Stage 2 executables…

Microsoft Security

Where’s the Macro? Malware authors are now using OLE embedding to deliver malicious files

January 23, 2017 admin Antimalware research for IT pros and enthusiasts, CAPTCHA, Cerber, Donvibs, macro malware, Macro-based malware, malicious JS scripts, malicious VB files, Microsoft Office, office, OLE-embedded objects, ransomware, TrojanDownloader:VBS/Donvibs, TrojanDownloader:VBS/Vibrio, Vibrio

Recently, we’ve seen reports of malicious files that misuse the legitimate Office object linking and embedding (OLE) capability to trick users into enabling and downloading malicious content. Previously, we’ve seen macros used in a similar matter, and this use of OLE might indicate a shift in behavior as administrators and enterprises are mitigating against this…

Microsoft Security

Link (.lnk) to Ransom

January 23, 2017 admin Antimalware research for IT pros and enthusiasts, detect ransomware, macro malware, OneDrive backup, prevent ransomware, ransomware, ransomware detection, ransomware prevention, ransomware recovery, recover from ransomware attack, spam email infection vector, Windows Defender, worm, worm-like ransomware, wormable ransomware

We are alerting Windows users of a new type of ransomware that exhibits worm-like behavior. This ransom leverages removable and network drives to propagate itself and affect more users. We detect this ransomware as Ransom:Win32/ZCryptor.A. Infection vector Ransom:Win32/ZCryptor.A is distributed through the spam email infection vector. It also gets installed in your machine through…

Microsoft Security

Malicious macro using a sneaky new trick

January 23, 2017 admin antimalware, Antimalware research for IT pros and enthusiasts, Donoff, guidance, Locky, macro, Macro-based malware, malware, malware research, office, ransomware, Social engineering, VBA, VBAscript, Windows 10, Windows Defender, Word

We recently came across a file (ORDER-549-6303896-2172940.docm, SHA1: 952d788f0759835553708dbe323fd08b5a33ec66) containing a VBA project that scripts a malicious macro (SHA1: 73c4c3869304a10ec598a50791b7de1e7da58f36). We added it under the detection TrojanDownloader:O97M/Donoff – a large family of Office-targeting macro-based malware that has been active for several years (see our blog category on macro-based malware for more blogs). However, there wasn’t…

Microsoft Security

Locky malware, lucky to avoid it

January 23, 2017 admin Antimalware research for IT pros and enthusiasts, Bartallex, Locky, macro, macros, maps, Microsoft Active Protection Service, Office 16, Office 365 Advanced Threat Protection, Ransom:Win32/Locky.A, ransomware, Windows Defender blogs for home users and small businesses

You may have seen reports of the Locky malware circulating the web; we think this is a good time to discuss its distribution methods, and reiterate some best-practice methods that will help prevent infection. We’ve seen Locky being distributed by spam email, not in itself a unique distribution method, but this means that spreading is…