Malware descriptions

New Worm.SymbOS.Lasco.a

Analysis of the new virus mentioned in the previous posting showed that it’s a SymbianOS worm, based on Cabir source code, that spreads itself via BlueTooth. It also has a file infection functionality.

Upon execution, the virus searches for nearby BlueTooth devices (those which are in discoverable mode) and tries to transmit itself to any accessible ones. It also initiates a drive-wide scan for SIS-files and tries to infect them by inserting virus code directly into an SIS archive.

We’ve called this virus Worm.SymbOS.Lasco.a. An antivirus database update is already available.

A detailed description of the virus will be available in the Virus Encyclopedia in the near future.

UPDATE: the description of Lasco.a is now online.

New Worm.SymbOS.Lasco.a

Your email address will not be published.

 

Reports

Kimsuky’s GoldDragon cluster and its C2 operations

Kimsuky (also known as Thallium, Black Banshee and Velvet Chollima) is a prolific and active threat actor primarily targeting Korea-related entities. In early 2022, we observed this group was attacking the media and a think-tank in South Korea.

Andariel deploys DTrack and Maui ransomware

Earlier, the CISA published an alert related to a Stairwell report, “Maui Ransomware.” Our data should openly help solidify the attribution of the Maui ransomware incident to the Korean-speaking APT Andariel, also known as Silent Chollima and Stonefly.

Subscribe to our weekly e-mails

The hottest research right in your inbox