Home » Malware

XLoader Android Spyware and Banking Trojan Distributed via DNS Spoofing

Posted on:April 19, 2018 at 6:06 pm
Posted in:Bad Sites, Malware, Mobile
Author:
Lorin Wu (Mobile Threats Analyst)

We have been detecting a new wave of network attacks since early March, which, for now, are targeting Japan, Korea, China, Taiwan, and Hong Kong. The attacks use Domain Name System (DNS) cache poisoning/DNS spoofing, possibly through infringement techniques such as brute-force or dictionary attacks, to distribute and install malicious Android apps. Trend Micro detects these as ANDROIDOS_XLOADER.HRX.

These malware pose as legitimate Facebook or Chrome applications. They are distributed from polluted DNS domains that send a notification to an unknowing victim’s device. The malicious apps can steal personally identifiable and financial data and install additional apps. XLoader can also hijack the infected device (i.e., send SMSs) and sports self-protection/persistence mechanisms through device administrator privileges.

Posted on:April 19, 2018 at 6:00 am
Posted in:Malware, Spam
Author:
Trend Micro

We discovered a spam campaign that delivers the notorious cross-platform remote access Trojan (RAT) Adwind a.k.a. jRAT (detected by Trend Micro as JAVA_ADWIND.WIL) alongside another well-known backdoor called XTRAT a.k.a XtremeRAT (BKDR_XTRAT.SMM). The spam campaign also delivered the info-stealer Loki (TSPY_HPLOKI.SM1).

DUNIHI (VBS_DUNIHI.ELDSAVJ), a known VBScript with backdoor and worm capabilities, was also seen being dropped with Adwind via spam mail in a separate incident. Notably, cybercriminals behind the Adwind-XTRAT-Loki and Adwind-DUNIHI bundles abuse the legitimate free dynamic DNS server hopto[.]org. The delivery of different sets of backdoors is believed to be a ploy used to increase the chances of system infection: If one malware gets detected, the other malware could attempt to finish the job.

Posted on:April 17, 2018 at 6:39 am
Posted in:Malware
Author:
Trend Micro

Currently, cryptocurrency miners are heavily used by malware—we’ve seen miners injected onto ad platforms, on popular mobile devices, and servers. Malware creators change payloads to maximize their chances to make a profit, and in this volatile cryptocurrency landscape, they seem committed to integrating miners into their arsenal. We are now also seeing binary infectors using miners to suit their needs.

Posted on:April 17, 2018 at 2:03 am
Posted in:Internet of Things, Malware
Author:
Fernando Mercês (Senior Threat Researcher)

Even before the term IoT was coined, we had the routers at the gateway, most of the time publicly exposed on the internet. In the context of the IoT, the router is perhaps the most important device for the whole infrastructure. All traffic goes through it and it allows for the provision of many services, such as Dynamic Host Configuration Protocol (DHCP), Domain Name System (DNS), content filtering, firewalls, and Voice over Internet Protocol (VoIP), to all connected devices, including computers, smartphones, and IP cameras. If an attacker is able to compromise the router, every device connected to it can be affected. And that’s what a hacking group in Brazil just did.

Posted on:April 12, 2018 at 5:00 am
Posted in:Malware
Author:
Marco Balduzzi (Senior Threat Researcher)

In this blog post, we will discuss how we developed a human-readable machine learning system that is able to determine whether a downloaded file is benign or malicious in nature.

The development of this actionable intelligent system stemmed from the question: How can we make our knowledge about global software download events actionable? More specifically, how can we use such information to do a better job at detecting the threats posed by the large amounts of new malicious software circulating on a daily basis?

In this last installment of this blog series, we will answer such questions and give a summary of what we did with the information we’ve obtained. Our research paper titled Exploring the Long Tail of (Malicious) Software Downloads provides a more comprehensive look into how we’ve gathered and analyzed our software downloads data.

Page 1 of 26412 › »

XLoader Android Spyware and Banking Trojan Distributed via DNS Spoofing

XTRAT and DUNIHI Backdoors Bundled with Adwind in Spam Mails

Ransomware XIAOBA Repurposed as File Infector and Cryptocurrency Miner

Not Only Botnets: Hacking Group in Brazil Targets IoT Devices With Malware

Uncovering Unknown Threats With Human-Readable Machine Learning

Security Predictions for 2018

Business Process Compromise

Stay Updated

XLoader Android Spyware and Banking Trojan Distributed via DNS Spoofing

XTRAT and DUNIHI Backdoors Bundled with Adwind in Spam Mails

Ransomware XIAOBA Repurposed as File Infector and Cryptocurrency Miner

Not Only Botnets: Hacking Group in Brazil Targets IoT Devices With Malware

Uncovering Unknown Threats With Human-Readable Machine Learning

Security Predictions for 2018

Business Process Compromise

Popular Posts

Stay Updated