hasherezade – Computer Security Articles

TrickBot adds new trick to its arsenal: tampering with trusted texts

September 3, 2019 admin 2fa, account takeover fraud, ATO, Authy, C&C, Dell Secureworks, dynamic webinject, dyreza, emotet, Eternal Romance, EternalBlue, EternalChampion, Gold Blackburn, Google Authenticator, hasherezade, point-of-sale, port-out fraud, pos, SIM hijacking, SIM swapping, Sprint, T-Mobile, thetrick, trickbot, trickloader, trickster, Trojan.TrickBot, trojans, two-factor authentication, Verizon Wireless

Credit to Author: Jovi Umawing| Date: Tue, 03 Sep 2019 15:26:01 +0000

TrickBot’s latest feature allows it to tamper with the web sessions of users from Verizon, T-Mobile, and Sprint mobile carriers.

Categories:

Trojans

Tags: 2fa account takeover fraud ATO Authy C&C Dell Secureworks dynamic webinject dyreza emotet Eternal Romance EternalBlue EternalChampion Gold Blackburn Google Authenticator hasherezade point-of-sale port-out fraud POS SIM hijacking SIM swapping Sprint T-Mobile thetrick trickbot trickloader trickster Trojan.TrickBot two-factor authentication Verizon Wireless

MalwareBytes Security

EternalPetya – yet another stolen piece in the package?

June 30, 2017 admin attribution, EternalPetya, hasherezade, hexedit, janus, malware, Malwarebytes, NotPetya, NSA, Petya, psexec, ransomware, Threat analysis

Credit to Author: Malwarebytes Labs| Date: Fri, 30 Jun 2017 16:53:36 +0000

Since 27th June we’ve been investigating the outbreak of the new Petya-like malware armed with an infector similar to WannaCry. Since the day one, various contradicting theories started popping up. Some believed, that it is a rip-off the original Petya, others – that it is another step in its evolution. However, so far, those were just different opinions, and none of them was backed up with enough evidence. In this post, we will try to fill this gap, by making a step-by-step comparison of the current kernel and the one on which it is based (Goldeneye Petya).

Categories:

Tags: attribution EternalPetya hasherezade hexedit janus Malwarebytes NotPetya NSA petya psexec ransomware

MalwareBytes Security

LatentBot piece by piece

June 8, 2017 admin hasherezade, latentbot, malware, malwarebytes labs, RIG EK, Threat analysis

Credit to Author: Malwarebytes Labs| Date: Thu, 08 Jun 2017 15:00:53 +0000

LatentBot is a multi-modular Trojan written in Delphi and known to have been around since 2013. Recently, we captured and dissected a sample distributed by RIG Exploit Kit. In this post we will describe its modules by taking apart several layers of obfuscation and encryption in order to reveal their true nature.

Categories:

Tags: hasherezade latentbot malwarebytes labs RIG EK

(Read more…)

The post LatentBot piece by piece appeared first on Malwarebytes Labs.

MalwareBytes Security

Explained: Sage ransomware

March 29, 2017 admin encryption, hasherezade, malware, phish, ransomware, Sage ransomware, Spora Ransomware, Threat analysis

Credit to Author: Malwarebytes Labs| Date: Wed, 29 Mar 2017 15:00:24 +0000

Sage is yet another ransomware that has become a common threat nowadays. Similarly to Spora, it has capabilities to encrypt files offline. The malware is actively developed and currently, we are facing outbreak of version 2.2. of this product.

Categories:

Tags: encryption hasherezade malware phish ransomware Sage ransomware Spora Ransomware

(Read more…)

The post Explained: Sage ransomware appeared first on Malwarebytes Labs.

MalwareBytes Security

Goldeneye Ransomware – the Petya/Mischa combo rebranded

January 18, 2017 admin Cerber ransomware, Goldeneye ransomware, hasherezade, malware, Mischa ransomware, Petya ransomware, phishing, ransomware, Satana ransomware, Threat analysis

From March 2016 we’ve observed the evolution of an interesting low-level ransomware, Petya. Now, we are facing an outbreak of the fourth version – this time under a new name – Goldeneye, and, appropriately, a new, golden theme.

Categories:

Tags: Cerber ransomware Goldeneye ransomware hasherezade malware Mischa ransomware Petya ransomware phishing ransomware Satana ransomware

(Read more…)

MalwareBytes Security

From a fake wallet to a Java RAT

January 18, 2017 admin Adwind, bitcoin, cybercrime, decryptor, hasherezade, JRAT bot, malware, phishing

We take a look at Adwind, one of the most popular Java Remote Administration Tool. This RAT was distributed via a phishing email and amongst other things, can steal credentials or capture screenshots on the infected machine.

Categories:

Tags: Adwind bitcoin decryptor hasherezade JRAT bot malware phishing

(Read more…)