Threat Category: Windows malware | Page 30

We’ve recently detected a third modification of Email-Worm.Win32.Monikey. Our interest was piqued by the fact that Monikey incorporates modifications of Trojan-PSW.Win32.Vipgsm and Trojan-PSW.Win32.LdPinch.

We’ve decided to rename Net-Worm.Win32.Small.d to Net-Worm.Win32.Bozori.a. Infection reports are coming mostly from the USA, with some high-profile targets being hit.

We’ve received numerous reports on a new worm spreading via the PnP vulnerability. We detect it as Net-Worm.Win32.Small.d.

A quick update: over the last twenty four hours, we had eleven new Bagle variants, from Bagle.bz to Bagle.cj.

Today we’ve detected several new Bagle variants (actually old variants which have been repacked) and they are still coming in.

A few days ago we got another Trojan-Dropper. When we analyzed it, we found out that it installs 4 files to the system.

A professional malware market started to emerge at the very end of 2003, gained ground during 2004, and was well established by the beginning of 2005.

Over 2 years have gone by since we’ve seen a true virus in the wild. Most of us here had decided that they might actually be dead. And yet…

On July 13 we received the first sample of Tenga – a true blue virus. Tenga.a was followed by Tenga.b and finally Tenga.c, which arrive just…

Viruses and worms have evolved rapidly over the past few years and now pose a global threat. However, law enforcement agencies are also pooling their resources to gain a global reach.

In the last 24 hours we’ve detected five new versions of Virus.Win32.GPcode. This virus is interesting as it encrypts users’ files – with whoever is sending the virus out asking for money to decrypt the files.

Mytob became more active than Mydoom, its predecessor, and this trend looks set to continue. Mytob may come to effectively replace Mydoom.

New developments in Operation Horse Race

During the past hours, we’ve intercepted a flurry of new Bagle variants; apparently, it’s been a busy day for the author, who keeps sending them out.

Two new Bagle variants have been spotted today. Both are 36352 bytes in size and are very similar in operation.

Anniversary of first virus for Win64 platform

Reports

In this article, we discuss the tools and TTPs used in the SideWinder APT’s attacks in H2 2024, as well as shifts in its targets, such as an increase in attacks against the maritime and logistics sectors.

Kaspersky researchers analyze EAGERBEE backdoor modules, revealing a possible connection to the CoughingDown APT actor.

While investigating an incident involving the BellaCiao .NET malware, Kaspersky researchers discovered a C++ version they dubbed “BellaCPP”.

Lazarus targets employees of a nuclear-related organization with a bunch of malware, such as MISTPEN, LPEClient, RollMid, CookieTime and a new modular backdoor CookiePlus.

Windows malware

Monikey or: the continuing evolution of Bagle

60 seconds before shutdown – again

New PnP worm spreading

And the Bagles just keep on coming

Bagle’s author back at work

Downloader + file virus – a new approach?

Watershed in malicious code evolution

Classical viruses ITW – never say die

Global problem, global solution

Multiple Gpcode variants

Malware Evolution: May Roundup

New runner in Horse Race

More Bagle trouble

Fresh Bagles ahead

Rugrat a year old

Reports

SideWinder targets the maritime and nuclear sectors with an updated toolset

EAGERBEE, with updated and novel components, targets the Middle East

BellaCPP: Discovering a new BellaCiao variant written in C++

Lazarus group evolves its infection chain with old and new malware

Subscribe to our weekly e-mails