Home » Malware

Untangling the Ripper ATM Malware

Posted on:September 19, 2016 at 12:01 am
Posted in:Malware
Author:
Numaan Huq (Senior Threat Researcher)

Last August , security researchers released a blog discussing a new ATM malware family called Ripper which they believe was involved in the recent ATM attacks in Thailand. Large numbers of ATMs were also temporarily shut down as a precautionary measure.

During our analysis we noticed some additional details that where not called out, or which appear to contradict this earlier analysis. We highlight these differences in this blog post. We have also included technical indicators such as code offsets where possible for other researchers to follow on from our work.

Posted on:September 5, 2016 at 1:30 am
Posted in:Deep Web, Malware
Author:
Fernando Mercês (Senior Threat Researcher)

The Trend Micro Forward Looking Threat Research team recently obtained samples of a new rootkit family from one of our trusted partners. This rootkit family called Umbreon (sharing the same name as the Pokémon) targets Linux systems, including systems running both Intel and ARM processors, expanding the scope of this threat to include embedded devices as well. We detect Umbreon under the ELF_UMBREON family.

Posted on:August 31, 2016 at 8:28 pm
Posted in:Exploits, Malware, Ransomware
Author:
Joseph C Chen (Fraud Researcher)

Cerber has become one of the most notorious and popular ransomware families in 2016. It has used a wide variety of tactics including leveraging cloud platforms and Windows Scripting and adding non-ransomware behavior such as distributed denial-of-service attacks to its arsenal. One reason for this popularity may be because it is frequently bought and sold as a service (ransomware-as-a-service, or RaaS).

The latest version of Cerber had functions found in earlier versions like the use of voice mechanism as part of its social engineering tactics. Similar to previous variants, Cerber 3.0 is dropped by the Magnitude and Rig exploit kits.

Posted on:August 29, 2016 at 4:56 am
Posted in:Malware, Ransomware
Author:
Brooks Li (Threats Analyst)

The Locky ransomware family has emerged as one of the most prominent ransomware families to date, being sold in the Brazilian underground and spreading via various exploits. Locky has, over time, become known for using a wide variety of tactics to spread–including macros, VBScript, WSF files, and now, DLLs.

Recently we encountered a new Locky variant (detected as RANSOM_LOCKY.F116HM) that used old tactics on the surface, but with some key technical changes. The emails that were used to distribute it were fairly pedestrian as far as these messages go, although it was part of a large-scale spam campaign.

Posted on:August 25, 2016 at 4:00 am
Posted in:Malware, Ransomware
Author:
Trend Micro

In a span of one to two weeks, three new open source ransomware strains have emerged, which are based on Hidden Tear and EDA2. These new ransomware families specifically look for files related to web servers and databases, which could suggest that they are targeting businesses.

Both Hidden Tear and EDA2 are considered as the first open source ransomware created for educational purposes. However, these were quickly abused by cybercriminals. RANSOM_CRYPTEAR.B is one of the many Hidden Tear spinoffs that infect systems when users access a hacked website from Paraguay. Magic ransomware (detected as RANSOM_MEMEKAP.A), based on EDA2, came soon after CRYPTEAR.B’s discovery.

Page 1 of 24512 › »

Untangling the Ripper ATM Malware

Pokémon-themed Umbreon Linux Rootkit Hits x86, ARM Systems

New Version of Cerber Ransomware Distributed via Malvertising

Locky Ransomware Now Downloaded as Encrypted DLLs

New Open Source Ransomware Based on Hidden Tear and EDA2 May Target Businesses

Business Email Compromise

Deep Web

Latest Ransomware Posts

Ransomware 101

Stay Updated

Untangling the Ripper ATM Malware

Pokémon-themed Umbreon Linux Rootkit Hits x86, ARM Systems

New Version of Cerber Ransomware Distributed via Malvertising

Locky Ransomware Now Downloaded as Encrypted DLLs

New Open Source Ransomware Based on Hidden Tear and EDA2 May Target Businesses

Business Email Compromise

Deep Web

Latest Ransomware Posts

Ransomware 101

Popular Posts

Stay Updated