Virus and Spyware Removal Guides, uninstall instructions

What is "Internet Corporation For Assigned Names And Numbers (ICANN)"?

Our analysis of the email has shown that it is a fraudulent letter disguised as a notification from an email service provider. The scammers who created this email aim to extract personal information from recipients. It is worth noting that such emails are known as phishing emails. Recipients should know how to recognize them and ignore them.

What is "Share Your Company Catalog"?

We have scrutinized the email and found that it is written by scammers who attempt to trick recipients into believing they have received a request for a company catalog. Fraudulent emails like this one fall into the category of phishing emails. Usually, the goal is to steal personal information.

What kind of malware is SnipBot?

SnipBot is a variant of RomCom remote access Trojan (RAT) that allows attackers to execute commands on a victim's system and download additional modules. The new variant employs a custom obfuscation technique along with advanced anti-analysis methods. Threat actors have been observed distributing SnipBot via email by attaching a malicious file.

What kind of page is ladsnow[.]com?

Our examination of ladsnow[.]com has revealed that the purpose of this web page is to deliver shady notifications. However, it cannot send them without user permission. To obtain this permission, ladsnow[.]com utilizes clickbait (a deceptive method). Users should not trust ladsnow[.]com and avoid opening it.

What is the fake "Claim Aerodrome Rewards" website?

Our research team discovered this "Claim Aerodrome Rewards" scam, as promoted on distribution-aerodrome-6uo.pages[.]dev (could also be hosted elsewhere), during a routine investigation of suspect sites. This fake platform claims to be distributing various rewards. It operates as a cryptocurrency drainer – i.e., by stealing digital assets from victims' cryptowallets.

What kind of email is "Samples Of The Product"?

After inspecting the "Samples Of The Product" email, we determined that it is spam. It is presented as a potential purchase order. The spam mail enticed recipients into visiting a phishing website that targets their email account log-in credentials.

It must be stressed that the information in this email is false, and this mail is in no way associated with the actual Sanmina Corporation or any other genuine entities.

What kind of page is miwgh.co[.]in?

Miwgh.co[.]in is a rogue webpage that is designed to promote browser notification spam and redirect visitors to different (likely dubious/malicious) websites.

The majority of users access pages like this via redirects caused by sites that utilize rogue advertising networks. Our research team discovered miwgh.co[.]in during a routine inspection of a Torrenting website that uses such networks.

What kind of malware is Octo2?

Octo2 is a new version of the Octo banking Trojan targeting Android users. Compared to the old version, the Octo2 includes improved RAT capabilities and anti-analysis and anti-detection techniques. If there is a reason to suspect that a device is infected with Octo2, a scan using a reputable security tool should be run as soon as possible.

What is "$WSM Airdrop"?

Our inspection of the site (claim-wallstreetmemes.pages[.]dev) has shown that it is one of the scams involving fraudulent offers to participate in an airdrop (cryptocurrency giveaway). The scammers behind these scams aim to trick individuals into taking actions that can result in huge financial losses. Thus, it is important to recognize and avoid such scams.

What is the fake "Claim $REZ" website?

While investigating deceptive sites, our researchers discovered the "Claim $REZ" scam. It was endorsed on renzoprotocal.pages[.]dev, but it could be hosted elsewhere. The scheme is presented as an airdrop. However, this "Claim $REZ" page functions as a cryptocurrency drainer. Victims of this scam experience financial loss.