Trojan – Page 8 – Computer Security Articles

Windows 10: protection, detection, and response against recent Depriz malware attacks

A few weeks ago, multiple organizations in the Middle East fell victim to targeted and destructive attacks that wiped data from computers, and in many cases rendering them unstable and unbootable. Destructive attacks like these have been observed repeatedly over the years and the Windows Defender and Windows Defender Advanced Threat Protection Threat Intelligence teams…

Microsoft Security

Fake fax ushers in revival of a ransomware family

January 23, 2017 admin antimalware, Antimalware research for IT pros and enthusiasts, Crimace, enterprise software security, fake fax, malware research, microsoft, Microsoft Edge, MMPC, Ransom:Win32/WinPlock.B, ransomware, research, spam, Trojan, TrojanDownloader:JS/Crimace.A, Windows 10, Windows Defender, Windows Defender for Windows 10, WinPlock

“Criminal case against you” is a message that may understandably cause panic. That’s what a recent spam campaign hopes happens, increasing the likelihood of recipients opening the malicious attachment. We recently discovered a new threat that uses email messages pretending to be fax messages, but in truth deliver a ransomware downloader. The attachment used in this…

Microsoft Security

MSRT October 2016 release: Adding more unwanted software detections

January 23, 2017 admin BrowserModifier:Win32/Sasquor, BrowserModifier:Win32/SupTab, Checking Windows Defender exclusions, Ghokswa, Microsoft Edge, Microsoft Malicious Software Removal Tool, MSRT, MSRT release October 2016, Objective Criteria, Sasquor, software bundler, SupTab, Suweezy, Trojan, Trojan:Win32/Ghokswa, Trojan:Win32/Suweezy, Trojan:Win32/Xadupi, Uncategorized, Unwanted software, Windows 10, Windows Defender, Xadupi

Unwanted software often piggy-backs on program downloads, delivered by software bundlers. These bundles, which you might have downloaded, can include software that you do not want, and some that are harmful. The bundled or “extra” software can perform actions on your device that run the gambit from unwanted to annoying to malicious. The threat that…

Microsoft Security

The new .LNK between spam and Locky infection

January 23, 2017 admin .LNK between spam and Locky, .Lnk embedded PowerShell command, .Lnk embedded PowerShell script, .LNK spam spreads Locky infection, Antimalware research for IT pros and enthusiasts, email spam, Locky ransomware, Nemucod and Locky, Ransom:Win32/Locky, ransomware, spammed .Lnk spreads Locky, Trojan, TrojanDownloader:PowerShell/Ploprolo.A, Windows Defender, Windows Defender ATP, Windows Defender in Windows 10

Just when it seems the Ransom:Win32/Locky activity has slowed down, our continuous monitoring of the ransomware family reveals a new workaround that the authors might be using to keep it going. The decline in Locky activity can be attributed to the slowdown of detections of Nemucod, which Locky uses to infect computers. Nemucod is a…

Microsoft Security

Double-click me not: Malicious proxy settings in OLE Embedded Script

January 23, 2017 admin Antimalware research for IT pros and enthusiasts, JavaScript, JavaScript spam attachment, JScript, JScript malware, JScript malware prevention, Macro-based malware, malware-prevention blog, mitigate OLE misuse, obfuscated JScript, OLE misuse mitigation, OLE-embedded objects, Social engineering, spam, spam email infection vector, Trojan, Trojan:JS/Certor.A, Trojan:PowerShell/Certor.A, Windows Defender

Attackers have been using social engineering to avoid the increasing costs of exploitation due to the significant hardening and exploit mitigations investments in Windows. Tricking a user into running a malicious file or malware can be cheaper for an attacker than building an exploit which works on Windows 10. In our previous blog, Where’s the…

Microsoft Security

Nemucod dot dot..WSF

January 23, 2017 admin Antimalware research for IT pros and enthusiasts, JavaScript, JavaScript spam attachment, JS attachment, Nemucod, Nemucod infection chain, Nemucod mitigation, Social engineering, spam, Trojan, Windows Scripting File, WSF

The latest Nemucod campaign shows the malware distributing a spam email attachment with a .wsf extension, specifically ..wsf (with a double dot) extension. It is a variation of what has been observed since last year (2015) – the TrojanDownloader:JS/Nemucod malware downloader using JScript. It still spreads through spam email attachment, typically inside a .zip file,…

Microsoft Security

Kovter becomes almost file-less, creates a new file type, and gets some new certificates

January 23, 2017 admin Antimalware research for IT pros and enthusiasts, Kovter, malvertising, Trojan

Trojan:Win32/Kovter is a well-known click-fraud malware which is challenging to detect and remove because of its file-less persistence on infected PCs. In this blog, we will share some technical details about the latest changes we have seen in Kovter’s persistence method and some updates on their latest malvertising campaigns. New persistence method Since June 2016,…

Microsoft Security

Large Kovter digitally-signed malvertising campaign and MSRT cleanup release

January 23, 2017 admin Kovter, Locky, Macro-based malware, Malvertising campaign, maps, MSRT, ransomware, Trojan, Windows Defender, Windows Defender for Windows 10

Kovter is a malware family that is well known for being tricky to detect and remove because of its file-less design after infection. Users from United States are nearly exclusively being targeted, and infected PCs are used to perform click-fraud and install additional malware on your machine. Starting April 21, 2016, we observed a large…