Virus and Spyware Removal Guides, uninstall instructions

What kind of malware is Mad Cat?

Mad Cat is a ransomware-type program discovered by our researchers during a routine inspection of new submissions to the VirusTotal platform. Malware within this classification operates by encrypting files to demand payment for its decryption.

On our test machine, Mad Cat encrypted files and altered their filenames. Original names were appended with an extension consisting of four random characters, e.g., a file titled "1.jpg" appeared as "1.jpg.6psf", "2.png" as "2.png.jwni", etc. After this process was concluded, the desktop wallpaper was changed, and a ransom note titled "HACKED.txt" was created.

What kind of email is "PCRF"?

It is common for scams promoted through spam campaigns to take advantage of ongoing crises, and this "PCRF" email is no exception. This mail's backdrop is the 2023 Israel–Hamas war, and the email is presented as a donation request from Palestine Children's Relief Fund (PCRF).

It must be stressed that this spam mail is in no way associated with the actual non-governmental and nonprofit organization. Hence, by transferring cryptocurrency to the provided wallet – the recipient will be sending their funds to scammers.

What kind of software is Art Tab Club?

Art Tab Club is a rogue extension that promises to display artistic or art-depicting browser wallpaper. However, this piece of software is actually a browser hijacker. It changes browser settings to endorse (through redirects) the arttabclub.com fake search engine. It must be mentioned that this browser extension has data-tracking functionalities as well.

What kind of email is "HSBC - Payment Swift Copy"?

After analyzing the "HSBC - Payment Swift Copy" email, we determined that it is spam. Presented as a notification from HSBC regarding a payment, this letter aims to deceive recipients into providing their email account log-in credentials (passwords) to a phishing website.

What kind of software is ChrysanthemumLeucanthemum?

ChrysanthemumLeucanthemum is the name of a malicious browser extension that our research team discovered while inspecting suspicious sites. This extension's functionalities include manipulation of browsers' applications, extensions, themes, etc. It also collects vulnerable information from browsers.

What kind of malware is BlazeStealer?

BlazeStealer is a malicious program that steals sensitive data from devices. Typically, malware of this kind targets browsing and finance related information. This stealer is offered for sale on the Web; at the time of writing, it is sold for under 16 USD.

What kind of software is CygnusOlor?

While investigating deceptive websites, our research team discovered an installation setup containing the CygnusOlor browser extension. Compatible with Google Chrome and Microsoft Edge, this piece of software is capable of performing a variety of malicious activities like collecting sensitive information, manipulating applications/extensions, and so on.

What kind of email is "Webmail Software Upgrade"?

After analyzing the "Webmail Software Upgrade" email, we determined that it is spam. This phishing mail aims to trick recipients into thinking that their email accounts need to be upgraded, thus deceiving them into disclosing their log-in credentials.

What kind of application is Web Comic Tab?

Web Comic Tab application is an application offering users wallpapers for their homepage. Nonetheless, it has come to light that the true intention behind Web Comic Tab is to take control of web browsers. This is accomplished by altering specific browser settings effectively changing them to promote webcomictab.com.

What kind of application is EchinaceaPurpurea?

Upon testing the EchinaceaPurpurea application, it has been determined that it is a malicious browser extension targeting Google Chrome and Microsoft Edge browsers. EchinaceaPurpurea can access certain data and manipulate applications, among other actions. This extension has been discovered during an analysis of a malicious installer obtained from a dubious website.