Malware descriptions

Bagles massively spammed

Over the course of the last hours we’ve been seeing a number of new Bagles massively spammed.

They are detected as Email-Worm.Win32.Bagle.ed-eg.

As before these Bagles don’t have a functioning emailing routine.

These Bagles are likely to arrive in a .zip archive with both the archive as the executable having a random name.

Some quick info on the most common ones:(Note that filenames may vary)

File: Loader.exe –
MD5: 7b2f9ddebd027d54e36408c89804afdb
Size: 9728 bytes

File: t_535475.exe – Email-Worm.Win32.Bagle.ef
MD5: 8275444ac2caac4b90bfd07d0b2b17be
Size: 13312 bytes

File: text.exe –
MD5: 18ae7a2fa4dbbf703c3ae157f224186a
Size: 10752 bytes

Bagles massively spammed

Your email address will not be published.



Kimsuky’s GoldDragon cluster and its C2 operations

Kimsuky (also known as Thallium, Black Banshee and Velvet Chollima) is a prolific and active threat actor primarily targeting Korea-related entities. In early 2022, we observed this group was attacking the media and a think-tank in South Korea.

Andariel deploys DTrack and Maui ransomware

Earlier, the CISA published an alert related to a Stairwell report, “Maui Ransomware.” Our data should openly help solidify the attribution of the Maui ransomware incident to the Korean-speaking APT Andariel, also known as Silent Chollima and Stonefly.

Subscribe to our weekly e-mails

The hottest research right in your inbox