Zerophage Malware

[Zerophage Malware Index]

July-24-19 -> An update on what I’ve been up to.

zeroshell

 

August-17-18 -> Rig EK via HookAds drops AZORult loading Quasar RAT

AzoRultQuasar

June-15-18 -> GranSoftEK drops GandCrab via Ascentor Loader.

GrandTttraffic

 

May-22-18 ->RIG EK via Ngay drops Smokeloader -> XMR MinerNgay

April-16-18 -> Rig EK via Malvertising drops Smoke LoaderRigSmokePic

April-09-18 -> Rig EK drops GandCrab Ransomware Via CVE-2018-4878

RigEKGandCrab

Febuary-09-18 ->GrandSoft EK via Slots drops Leviarcoin MinerGrandSoftMiner

 

January-23-18 -> Maldoc (RTF) drops Loda Logger

LodaLogger

December-10-17 -> Malware – Snatch Loader: Reloaded

October-17-17 ->Rig EK drops Ursnif/ISFB variant

UIrsnifRifg

October-14-17 ->Rig EK drops Smoke loaders leading to XMR Miner.

XMRRig

October-13-17 ->Rig EK via Malvertising drops a Smoke Loader leading to a Miner and AZORult.

RigMiner

 

September-21-17 ->Rig EK via Rulan drops an InfostealerRigInfo

September-11-17 ->Rig EK via Rulan drops Quant Loader (leads to Ursnif)QuantLoader

August-06-17 ->Rig EK Drops Bunitu, Smoke Loader, Andromeda and a Minerquadrig

August-02-17 ->Rig EK via malvertising drops a trojan/infostealerRigTrojan

August-01-17 -> Rig EK via JavaScript Re-director drops UrlZone Trojan Banker.RigUrlZone

August-01-17 -> Magnitude EK XML Package and changes.

 

July-31-17 -> Three Rig EK Campaigns

refferers

July-16-17 -> Rig EK via Malvertising drops Panda Banker ZeusPanda

July-14-17 -> Rig EK delivers Kronos Banker

Kronos

July-03-17 -> Magnitude EK drops Cerber (Scriplet changed to “.bmp”)

MagnitudeBMP

June-28-17 ->Magnitude EK drops “CBRB” (Cerber Ransomware)MagnitudeEK28

June-24-17 ->Rig & Magnitude + 1000 follower Post

ZerophageCelebration

June-23-17 ->Rig EK via JS Redirector leads to Pushdo dropping Cutwail.RigCutwail

June-16-17 -> Four Rig EK Flows from Malvertising (Bunitu & Chthonic)

MultiRig

June-14-17 -> Rig EK via malvertising drops Dreambot

Dreambot

June-12-17 -> Rig EK via Malvertising drops Zloader and ChthonicDCDcY96XcAEyez2

June-7-17 -> Rig EK via Fake EVE Online website drops Bunitu.hehre

June-6-17 -> Rig EK Via RoughTed Delivers Chthonic

gergeggr

Jun-5-17 ->Rig EK via RoughTed drops a Miner

RigRoughMiner

May-31-17 ->Magnitude EK via RoughTed drops Cerber Ransomware

MAgnitudeRoughTed

May-30-17 ->Rig EK via RoughTed Malvertising drops Kovter

RigRoughTedKovter

May-25-17 -> Magnitude EK via malvertising delivers Cerber Ransomware

240517MagnitudeCerber

May-19-17 -> Rig EK via TDS drops Smoke Loader, leads to TeamViewer.

RigSmoke

May-17-17 -> Magnitude EK via Malvertising drops Cerber Ransomware

16MagnitudeCerber

May-15-17 -> Rig EK drops Pony, leads to Philadelphia Ransomware

RigPonyRansom

May-14-17 -> Rig EK delivers Chthonic

RigChthonic

May-12-17 -> Rig EK drops Bunitu Proxy Trojan

RigBunitu

May-09-17 ->  Rig EK drops failed payload. (new params)RigEKFailed

Apr-27-17 -> Rig EK via Decimal Redirect Drops Smoke Loader.

Rigsmoke

Apr-27-17 -> Multiple Magnitude EK drops Cerber Ransomware Samples

26MagCerber

Apr-21-17 -> Magnitude EK delivers Cerber

MagnitudeEKCerber

Apr-20-17 -> Magnitude EK URL’s from 14-20 April

URLs200417MagnitudeEK

Apr-14-17  -> Terror EK via Malvertising drops Smoke Loader

130417-TerrorEK

Apr-11-17  ->Unknown EK from Magnitude EK Gate drops Loader.

Apr-10-17  -> Rig EK via Malvertising delivers Bunitu

100417-RigBunitu

Apr-2-17  -> Terror EK delivers K.I.N.S.

TerrorEKZeuSVMKINS

Apr-1-17  -> Terror EK delivers BitCoin Miner

290317TerrorEK

Mar-29-17  -> Rig EK delivers Smoke Loader

RigEKSmokeLoader

Mar-24-17  ->Terror EK via Malvertising delivers Tofsee Spambot

TerrorEK-Tofsee

Mar-23-17  ->Magnitude EK via Malvertising

MagnitudeEK

Mar-20-17  ->Rig EK delivers Bunitu Proxy Trojan

RigEKBunitu

Mar-18-17  ->Rig EK via Malvertising delivers ZeuS Panda

RigEKZeuSPanda

Mar-13-17  ->Rig EK via Malvertising delivers ZeuS variant Chthonic.

RigChthonic

Mar-08-17  ->Sundown EK delivers ZeuS Panda (but C2 offline)

070317-SundownZeuSPanda

Mar-08-17  ->Rig EK delivers August Stealer

040317-RigAugust

Mar-06-17 ->Sundown EK delivers Zloader and Zbot

Sundown030717

Mar-01-17 ->Sundown EK delivers failed payload.

sundownfail

Feb-28-17 -> Rig EK via Malvertising delivers Bunitu.

bunitu270217

Feb-20-17 -> Rig EK via Malvertising drops Unknown DLL

rigunkdll

Feb-15-17 -> Rig EK via Malvertising delivers Bunitu Trojan

rigekbunitu

Feb-14-17 -> Sundown EK via Malvertising delivers Zloader

140217-sundownzloader

Feb-13-17 -> Rig via PseudoDarkleech delivers Cerber Ransomware

130217-rigcerber

Feb-02-17 -> Rig via PseudoDarkleech delivers Cerber Ransomware

050217-rigcerber

Jan-30-17 -> Rig via PseudoDarkleech delivers Cerber Ransomware

cerberba89

Jan-25-17 -> Rig-V via PseudoDarkleech delivers Cerber..

250117-rigcerber

Jan-23-17 -> Phishing email “Company Investigations” leads to Ursnif.

malspamphishing

Jan-19-17 -> Rig-V via PseudoDarkleech delivers Cerber?

190117rigcerber

Jan-15-17 ->  Compromised site with PseudoDarkleech (Rig EK and Cerber Ransomware) and Mobile Malware redirect.

mobilemalware
Jan-14-17 -> Older posts from Twitter
Jan-14-17 -> Welcome to Zerophage Malware!