While examining malware samples submitted to VirusTotal, our team discovered crYptA3 - malware that operates as ransomware. The purpose of crYptA3 is to encrypt files. Also, it provides a ransom note ("readme_for_unlock.txt" file) and appends the ".crYptA3" extension to filenames. An example of h
Vypt is ransomware that encrypts files stored on a computer, modifies filenames of all affected files, and creates two ransom notes ("Restore_Your_Files.txt" and "ReadMe.hta"). Our malware researchers discovered Vypt during examination of malware samples submitted to the VirusTotal site. Vypt app
The TrafficStealer malware employs open container APIs to redirect web traffic to specific sites and manipulate user interaction with ads. Through the use of Docker containers, this program generates profits by sending traffic to monetized destinations. Despite appearing to be legitimate, the so
Getbrowbeatgroup[.]com is a rogue page that our research team found while inspecting questionable websites. It is designed to push browser notification spam and redirect visitors to other (likely unreliable/hazardous) sites. Users typically access webpages like getbrowbeatgroup[.]com through redi
Our research team discovered the AttackSystem ransomware-type program while investigating new submissions to the VirusTotal website. This program is part of the MedusaLocker ransomware family. On our testing machine, AttackSystem encrypted data. The filenames of the affected files were appended w
While investigating new submissions to VirusTotal, our researchers discovered the CrypBits256 ransomware. This program belongs to the Xorist ransomware family. It is designed to encrypt data and demand payment for its decryption. When CrypBits256 was executed on our test system, it began encrypti
Upon examination of the CyclinGuru browser extension, we found that it takes over a web browser by altering its settings with the aim of promoting a fake search engine called privatesearchqry.com. As a result, we have classified CyclinGuru as a browser hijacker. CyclinGuru browser extensio
Npdnnsgg[.]com is a rogue webpage that we discovered while investigating suspicious sites. It operates by promoting spam browser notifications and redirecting visitors to different (likely untrustworthy/harmful) websites. Most users access pages like npdnnsgg[.]com via redirects generated by sites
Our researchers found the Drinking Well browser extension while inspecting dubious sites. It is endorsed as a tool for tracking and improving users' hydration habits. However, our analysis of Drinking Well revealed that it is a browser hijacker, i.e., the extension modifies browser settings to pr
H3r is a ransomware discovered by our researchers during a routine inspection of new submissions to VirusTotal. This program is part of the Dharma ransomware family and operates by encrypting data in order to demand ransoms for its decryption. On our testing system, H3r renamed the encrypted file