While investigating new submissions to the VirusTotal site, our research team discovered the Black Hunt 2.0 ransomware. This malicious program encrypts data and demands ransoms for its decryption. On our test machine, Black Hunt 2.0 encrypted files by appending their filenames with a unique ID as
Our investigation revealed that this email is a phishing attempt, cleverly disguised as a letter from an email service provider. The scammers intend to deceive recipients into divulging sensitive personal information. To achieve this, they utilize a phishing website. The email claims that
Cactus is ransomware that encrypts data, provides a ransom note ("cAcTuS.readme.txt"), and appends the ".CTS1" extension to filenames. For instance, it renames "1.jpg" to "1.jpg.CTS1", "2.png.CTS1", and so forth. Cactus can use different encryption modes. Depending on the encryption mode used, Ca
LOCK2023 is ransomware that our malware researchers discovered while examining samples submitted to the VirusTotal website. LOCK2023 encrypts files, provides a ransom note ("README.txt"), and appends the ".LOCK2023" extension to filenames. For example, it renames "1.jpg" to "1.jpg.LOCK2023", "2.pn
FakeSG is the name of a malware campaign. It involves compromised websites that imitate the potential victim's browser and urge them to update it. However, instead of installing a browser upgrade, the victim inadvertently allows malicious software to infiltrate their device. The observed FakeSG c
HotRat is a robust Remote Access Trojan (RAT) based on the open-source AsyncRAT implementation. This malicious software empowers cybercriminals to steal sensitive data, inject additional malware, and perform other illicit activities. HotRat is typically distributed through unauthorized software do
Kizu is a ransomware variant that carries out file encryption and adds the ".kizu" extension to the filenames of all affected files. It also generates a ransom note titled "_readme.txt", which provides contact and payment instructions to the victim. Kizu is a member of the Djvu ransomware family a
During our examination of malware samples submitted to the VirusTotal website, we identified a ransomware variant referred to as Kiqu. This ransomware encrypts files and modifies their filenames by appending the ".kiqu" extension. Also, Kiqu generates a text file ("_readme.txt") which contains a r
Our research team found the ConfigInput app while inspecting new submissions to the VirusTotal website. After examining this application, we determined that it is advertising-supported software (adware) belonging to the AdLoad malware family. ConfigInput is designed to generate revenue for its d
After inspecting the "Mail Account Deactivation Notice" letter, we determined that it is a phishing email. This mail states that the recipient's account will be deactivated, and to prevent this – an authentication process using the email password is necessary. However, all these claims are fake an