# Malwares

LOCATION: malware/Binaries/OSX.OceanLotus
TYPE: apt
NAME: OceanLotus
VERSION: A & B
AUTHOR: APT32
LANGUAGE: bin
DATE: 2015-09-28
ARCHITECTURE: x64
PLATFORM: osx
TAGS: APT32,APT,MacOS,Vietnam
COMMENTS:
https://www.virustotal.com/#/file/12f941f43b5aba416cbccabf71bce2488a7e642b90a3a1cb0e4c75525abb2888/details


LOCATION: malware/Binaries/Win32.APT32.Windshield
TYPE: apt
NAME: APT32, WindShield
VERSION: NA
AUTHOR: APT32
LANGUAGE: bin
DATE: 2017-05-14
ARCHITECTURE: x86
PLATFORM: win32
TAGS: APT32, Vietnam, SEA
COMMENTS:
Original filename: 2017年员工工资性津贴额统计报告.doc
(2017 Statistical Report on Staff Salary and Allowances)

Further reference: https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html


LOCATION: malware/Binaries/Android.Skygofree
TYPE: trojan
NAME: Skygofree
VERSION: NA
AUTHOR: NA
LANGUAGE: java
DATE: 2018-01-18
ARCHITECTURE: arm
PLATFORM: android
COMMENTS:
Published by Kaspersky. Claiming HackingTeam. Several exploits for PE and CE.
https://securelist.com/skygofree-following-in-the-footsteps-of-hackingteam/83603/

TAGS:
Android, CVE-2013-2595, CVE-2013-3636, CVE-2013-2094, CVE-2014-3153, CVE-2013-6282, PE, android-rooting-tools


LOCATION: malware/Binaries/Win32.SofacyCarberp
TYPE: apt
NAME: SofacyCarberp
VERSION: Feb18
AUTHOR: Sofacy, APT28, Sednit
LANGUAGE: bin
DATE: 2018-02-26
ARCHITECTURE: x86
PLATFORM: win32
TAGS: APT28, Fancy Bear, Pawn Storm, Sednit, Tsar Team, Strontium, Russia, NATO, Middle East
COMMENTS:
https://www.securityweek.com/russia-linked-hackers-directly-targeting-diplomats-report
Feb 2018 campaign against foreign diplomats


LOCATION: malware/Binaries/Win32.GravityRAT
TYPE: trojan
NAME: GravityRAT
VERSION: NA
AUTHOR: NA
LANGUAGE: bin
ARCHITECTURE: x86
PLATFORM: win32
TAGS: India, Virtualization Detection, Unobfuscated, Easy, Good for Trainining
COMMENTS:
mono/.net. Novel method of checking VM by temperature measurement. 

https://blog.talosintelligence.com/2018/04/gravityrat-two-year-evolution-of-apt.html


LOCATION: malware/Binaries/Ransomware.Unnamed_0
TYPE: ransomware
NAME: Unnamed Ransomware
VERSION: NA
AUTHOR: NA
LANGUAGE: bin
DATE: 2018-04-05
ARCHITECTURE: x86
PLATFORM: win32
TAGS: .NET, Good for Training
COMMENTS:
mono/ .net . Malware contains encrypted .NET code which it compiles and decrypts in memory. Interesting technique. 
#MalwareHunterTeam https://twitter.com/malwrhunterteam/status/988774800964378624
https://www.bleepingcomputer.com/news/security/new-c-ransomware-compiles-itself-at-runtime/


LOCATION: malware/Binaries/Win32.GreenBug
TYPE: apt
NAME: GreenBug
VERSION: NA
AUTHOR: NA
LANGUAGE: NA
DATE: 2018-10-26
ARCHITECTURE: x86,x64
PLATFORM: win32,win64
TAGS: Iran, GreenBug
COMMENTS:
https://www.scmagazine.com/home/security-news/apts-cyberespionage/researchers-tentatively-link-greenbug-cyberspy-group-to-saudi-shamoon-attackers/


LOCATION: malware/Binaries/Coll.Coll.DarkHydrus
TYPE: apt
NAME: DarkHydrus
VERSION: NA
AUTHOR: NA
LANGUAGE: NA
DATE: 2018-08-07
ARCHITECTURE: x86
PLATFORM: win32
TAGS: DarkHydrus, paloaltonetworks, unit42, Middle East, RogueRobin
COMMENTS:
https://unit42.paloaltonetworks.com/unit42-darkhydrus-uses-phishery-harvest-credentials-middle-east/


LOCATION: malware/Binaries/Linux.Mirai.B
TYPE: apt
NAME: Mirai
VERSION: B
AUTHOR: Unknown
LANGUAGE: bin
DATE: 2020-07-28
ARCHITECTURE: arm
PLATFORM: linux
TAGS: IoT,Mirai,CVE-2020-5902
COMMENTS:
https://blog.trendmicro.com/trendlabs-security-intelligence/mirai-botnet-exploit-weaponized-to-attack-iot-devices-via-cve-2020-5902/


LOCATION: malware/Binaries/Win32.LuckyCat
TYPE: apt
NAME: LuckyCat, TA413
VERSION: NA
AUTHOR: TA413
LANGUAGE: bin
DATE: 2020-09-12
ARCHITECTURE: x86,x64
PLATFORM: win32, win64
TAGS: Sepulcher, Tibet, covid-19, TA413, ExileRAT, LuckyCat, ShadowNet, China, PRC
COMMENTS:
https://www.proofpoint.com/us/blog/threat-insight/chinese-apt-ta413-resumes-targeting-tibet-following-covid-19-themed-economic


LOCATION: malware/Binaries/Win32.FASTCash
TYPE: apt
NAME: FASTCash
VERSION: 2.0
AUTHOR: BeagleBoyz, Lazarus
LANGUAGE: bin
DATE: 2020-09-12
ARCHITECTURE: x86,x64
PLATFORM: win32, win64
COMMENTS:
https://us-cert.cisa.gov/ncas/alerts/aa20-239a
https://us-cert.cisa.gov/ncas/analysis-reports/ar20-239b
https://us-cert.cisa.gov/ncas/analysis-reports/ar20-239c
https://us-cert.cisa.gov/ncas/analysis-reports/ar20-239a

TAGS:
CROWDEDFLOUNDER , ELECTRICFISH , HOPLIGHT , VIVACIOUSGIFT , FASTCash , ECCENTRICBANDWAGON, BeagleBoyz, Lazarus, NorthKorea, Hidden Cobra


LOCATION: malware/Source/Original/Win9x.LegacyASM
TYPE: trojan
NAME: Assorted ASM Oldschool Trojans
VERSION: NA
AUTHOR: NA
LANGUAGE: ASM
DATE: 2020-11-20
ARCHITECTURE: x86
PLATFORM: win32
COMMENTS:
Win2k.CannaByte.asm, Win2k.Joss.asm, Win2k.Stream.asm, Win2k.CannaByte.v2.asm, Win2k.Ketamine.asm, Win2k.TaiChi.asm, Win2k.DOB.asm, Win2k.Society.3434.asm, Win32.FirstBorn.asm Win95.Altar.asm, , Win95.Lizard.asm, Win95.Babylonia.11036.asm, Win95.Mad.2736.asm, Win95.Bonk32.asm, Win95.Marburg.asm, Win95.Boobs.asm, , Win95.Matrix.asm, Win95.Espore.asm, Win95.Molly.725.asm, Win95.Estukista.asm, Win95.Obsolete.asm, Win95.Etymo-Crypt.asm, Win95.Radix.asm, Win95.Henze.asm, , Win95.Sk.asm, Win95.IceHeart.asm, Win95.Unreal.asm, Win95.Inca.asm, , Win95.Yildiz.asm, Win95.Invirsible.asm, Win95.Zombie.asm, Win95.K32.asm, Win98.BeGemot.8192.asm, Win98.Milennium.asm, Win98.Yobe.24576.asm, Win98.BlackBat.asm, Win98.Priest.asm Win9x.DarkMillennium.asm, Win9x.Sentinel.asm, Win9x.Estukista.asm, Win9x.Society.3434.asm, Win9x.Noise.asm, , Win9x.Wiedzmin.asm, Win9x.Repus.asm  WinCE.Dust.TXT


LOCATION: malware/Source/Original/Win32.Mirai
TYPE: trojan
NAME: Mirai Family
VERSION: NA
AUTHOR: NA
LANGUAGE: c, cpp
DATE: 2020-11-20
ARCHITECTURE: x86,x64
PLATFORM: win32, win64
COMMENTS:
Mirai.Linux.Apex_Predator, Mirai.Linux.Hades, Mirai.Linux.Reaper.a, Mirai.Linux.Arcane, Mirai.Linux.Joker, Mirai.Linux.Reaper.b, Mirai.Linux.B1nary, Mirai.Linux.Josho.b, Mirai.Linux.Rektbot, Mirai.Linux.BallPit, Mirai.Linux.Josho.c, Mirai.Linux.Renegade, Mirai.Linux.Beastmode.d, Mirai.Linux.Katrina.a, Mirai.Linux.Selfrep, Mirai.Linux.Cbot, Mirai.Linux.Kira, Mirai.Linux.Shinto.d, Mirai.Linux.CyberWar.b, Mirai.Linux.Kowai, Mirai.Linux.Sora, Mirai.Linux.Demeter.a, Mirai.Linux.L33t.d, Mirai.Linux.Sythe, Mirai.Linux.Demon.a, Mirai.Linux.L7, Mirai.Linux.Ultron.a, Mirai.Linux.Demon.e, Mirai.Linux.Lulz, Mirai.Linux.Void, Mirai.Linux.Eragon2.0.c, Mirai.Linux.Oblivion, Mirai.Linux.Yagi, Mirai.Linux.Execution.i, Mirai.Linux.Okami, Mirai.Linux.Yummy, Mirai.Linux.Extendo, Mirai.Linux.Onryo, Mirai.Linux.Zekrom, Mirai.Linux.FBot.a, Mirai.Linux.Oreo, Mirai.Linux.eragon.c, Mirai.Linux.Galaxy.d, Mirai.Linux.OwariReborn, Mirai.Linux.yakuza.c, Mirai.Linux.Galaxy.g, Mirai.Linux.Razor, 


LOCATION: malware/Binaries/WinX.SUNBURST
TYPE: apt
NAME: SUNBURST
VERSION: NA
AUTHOR: CozyBear
LANGUAGE: bin
DATE: 2020-12-17
ARCHITECTURE: x86,x64
PLATFORM: win32, win64
TAGS: SUNBURST, COZY BEAR, SOLAR WINDS,SupplyChain, Teardrop
COMMENTS:
A supply chain attack that compromised the update mechanism for SolarWinds Orion software has infected more than 2,000 computers at over 100 customers, according to security firm Symantec. and FireEye. This Symantec blog has been updated with analysis of the Teardrop second-stage malware and an example of the post-compromise attack chain. Symantec also has provided clarification on the use of Symantec’s name in a certificate used to sign the SolarWinds software.


LOCATION: malware/Binaries/Win32.Pay2Key.B
TYPE: apt
NAME: Pay2Key
VERSION: B
AUTHOR: FoxKitten
LANGUAGE: bin
DATE: 2020-12-17
ARCHITECTURE: x86,x64
PLATFORM: win32, win64
TAGS: Pay2Key, Iran, FOXKITTEN, APT33,
COMMENTS:
The Pay2Key Ransomware campaign is a new operation conducted by an Iranian APT group that is targeting Israeli companies, according to ClearSky.
https://www.clearskysec.com/wp-content/uploads/2020/12/Pay2Kitten.pdf


LOCATION: malware/Binaries/WinX.SignSight
TYPE: apt
NAME: Operation SignSight
VERSION: NA
AUTHOR: APT10
LANGUAGE: bin
DATE: 2020-12-17
ARCHITECTURE: x86,x64
PLATFORM: win32, win64
TAGS: SignSight, SEA,Vietnam, PhantomNet,SnowballS,SupplyChain
COMMENTS:
ESET researchers uncovered this new supply-chain attack in early December 2020 and notified the compromised organization and the VNCERT. We believe that the website has not been delivering compromised software installers as of the end of August 2020 and ESET telemetry data does not indicate the compromised installers being distributed anywhere else. The Vietnam Government Certification Authority confirmed that they were aware of the attack before our notification and that they notified the users who downloaded the trojanized software.
https://www.welivesecurity.com/2020/12/17/operation-signsight-supply-chain-attack-southeast-asia/


LOCATION: malware/Binaries/Win64.StealthyTrident
TYPE: apt
NAME: StealthyTrident
VERSION: NA
AUTHOR: Lucky Mouse
LANGUAGE: bin
DATE: 2020-12-17
ARCHITECTURE: x64
PLATFORM: win64
TAGS: LuckyMouse, TA428, HyperBro, Tmanger, ShadowPad, Able Desktop , SupplyChain, Korplug
COMMENTS:
ESET researchers discovered that chat software called Able Desktop, part of a business management suite popular in Mongolia and used by 430 government agencies in Mongolia (according to Able), was used to deliver the HyperBro backdoor (commonly used by LuckyMouse), the Korplug RAT (also known as PlugX), and a RAT called Tmanger (which was first documented by NTT Security and was used during Operation Lagtime IT campaigns attributed to TA428 by Proofpoint). A connection with the ShadowPad backdoor, which is now used by at least five different threat actors, was also found. 
https://www.welivesecurity.com/2020/12/10/luckymouse-ta428-compromise-able-desktop/


LOCATION: malware/Binaries/WinX.HiddenCobra.Supply
TYPE: apt
NAME: Bookcodes
VERSION: NA
AUTHOR: HIDDENCOBRA,Lazarus
LANGUAGE: bin
DATE: 2020-12-17
ARCHITECTURE: x86,x64
PLATFORM: win32, win64
TAGS: HIDDEN COBRA, Lazarus, South Korea, WIZVERA, SupplyChain
COMMENTS:
ESET telemetry data recently led our researchers to discover attempts to deploy Lazarus malware via a supply-chain attack in South Korea. In order to deliver its malware, the attackers used an unusual supply-chain mechanism, abusing legitimate South Korean security software and digital certificates stolen from two different companies.
https://www.welivesecurity.com/2020/11/16/lazarus-supply-chain-attack-south-korea/


LOCATION: malware/Binaries/All.ElectroRAT
TYPE: trojan
NAME: Operation ElectroRAT
VERSION: NA
AUTHOR: NA
LANGUAGE: bin
DATE: 2021-01-19
ARCHITECTURE: cross-platform
PLATFORM: cross-platform
TAGS: Operation ElectroRAT, Bitcoin, Crypto, Cybercrime, KPOT, Amadey
COMMENTS:
https://www.intezer.com/blog/research/operation-electrorat-attacker-creates-fake-companies-to-drain-your-crypto-wallets/


