# Malwares

LOCATION: malwares/Binaries/OSX.OceanLotus
TYPE: apt
NAME: OceanLotus
VERSION: A & B
AUTHOR: APT32
LANGUAGE: bin
DATE: 2015-09-28
ARCHITECTURE: x64
PLATFORM: osx
TAGS: APT32,APT,MacOS,Vietnam
COMMENTS:
https://www.virustotal.com/#/file/12f941f43b5aba416cbccabf71bce2488a7e642b90a3a1cb0e4c75525abb2888/details


LOCATION: malwares/Binaries/Win32.APT32.Windshield
TYPE: apt
NAME: APT32, WindShield
VERSION: NA
AUTHOR: APT32
LANGUAGE: bin
DATE: 2017-05-14
ARCHITECTURE: x86
PLATFORM: win32
TAGS: APT32, Vietnam, SEA
COMMENTS:
Original filename: 2017年员工工资性津贴额统计报告.doc
(2017 Statistical Report on Staff Salary and Allowances)

Further reference: https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html


LOCATION: malwares/Binaries/Android.Skygofree
TYPE: trojan
NAME: Skygofree
VERSION: NA
AUTHOR: NA
LANGUAGE: java
DATE: 2018-01-18
ARCHITECTURE: arm
PLATFORM: android
COMMENTS:
Published by Kaspersky. Claiming HackingTeam. Several exploits for PE and CE.
https://securelist.com/skygofree-following-in-the-footsteps-of-hackingteam/83603/

TAGS:
Android, CVE-2013-2595, CVE-2013-3636, CVE-2013-2094, CVE-2014-3153, CVE-2013-6282, PE, android-rooting-tools


LOCATION: malwares/Binaries/Win32.SofacyCarberp
TYPE: apt
NAME: SofacyCarberp
VERSION: Feb18
AUTHOR: Sofacy, APT28, Sednit
LANGUAGE: bin
DATE: 2018-02-26
ARCHITECTURE: x86
PLATFORM: win32
TAGS: APT28, Fancy Bear, Pawn Storm, Sednit, Tsar Team, Strontium, Russia, NATO, Middle East
COMMENTS:
https://www.securityweek.com/russia-linked-hackers-directly-targeting-diplomats-report
Feb 2018 campaign against foreign diplomats


LOCATION: malwares/Binaries/Win32.GravityRAT
TYPE: trojan
NAME: GravityRAT
VERSION: NA
AUTHOR: NA
LANGUAGE: bin
ARCHITECTURE: x86
PLATFORM: win32
TAGS: India, Virtualization Detection, Unobfuscated, Easy, Good for Trainining
COMMENTS:
mono/.net. Novel method of checking VM by temperature measurement. 

https://blog.talosintelligence.com/2018/04/gravityrat-two-year-evolution-of-apt.html


LOCATION: malwares/Binaries/Ransomware.Unnamed_0
TYPE: ransomware
NAME: Unnamed Ransomware
VERSION: NA
AUTHOR: NA
LANGUAGE: bin
DATE: 2018-04-05
ARCHITECTURE: x86
PLATFORM: win32
TAGS: .NET, Good for Training
COMMENTS:
mono/ .net . Malware contains encrypted .NET code which it compiles and decrypts in memory. Interesting technique. 
#MalwareHunterTeam https://twitter.com/malwrhunterteam/status/988774800964378624
https://www.bleepingcomputer.com/news/security/new-c-ransomware-compiles-itself-at-runtime/


