Site icon TheCyberThrone

Most Prevailed Malware Families a Review – Year 2022

PravinKarthik
Advertisements

Malware describes any malicious program created to wreak havoc or mischief on a computer system. Thanks to the constant push-and-pull between security professionals and cybercriminals, it’s also an ever-evolving ecosystem. Shifts in the malware environment change every year, although long-term trends are identifiable in year-over-year data reports.

Despite numerous anti-malware measures, cybercriminals and hackers don’t give up quickly, especially not as long as there’s money to be made in malware. Some traditionally-popular forms of malware appear to be losing traction in 2022 as cybercriminals change their tactics to attack new or underutilized vulnerabilities.

Source : CIS Security

Below are the Top Malware ranked in order of prevalence in alphabetical order. The respective indicators of compromise (IOCs) are provided to aid in detecting and preventing infections from these Top Malware variants. Note: The associated URIs are aligned with malware’s respective domain(s) or IP(s) and increase the likelihood of maliciousness when found together. The URIs alone are not inherently malicious.

Advertisements
Source : CIS Security

Like last year 2021, Emotet, XMRig, Formbook are the most prevailed malwares of this year too. Since we discussed the same in last year blog – Most Headlined Malware 2021. Other families are discussed below

Agent Tesla

Agent Tesla is a RAT that exfiltrate credentials, log keystrokes, and capture screenshots from an infected computer.

SHA256 Hashes

CoinMiner

CoinMiner is a cryptocurrency miner family that typically uses Windows Management Instrumentation (WMI) and EternalBlue to spread across a network. Additionally, it typically uses the WMI Standard Event Consumer scripting to execute scripts for persistence. However, due to multiple variants of this malware, capabilities may vary. CoinMiner spreads through malspam or is dropped by other malware.

MD5 Hashes

Delf

Delf is a family of malware with multiple variants written in the Delphi programming language, where most are downloaders. Campaigns, targets, infection vectors and capabilities vary based on the variant. Delf has multiple initial infection vectors, such as: dropped, malspam, or unintentional downloaded from a malicious website. Some of the abilities Delf variants exhibit include: backdoor or proxy functionality, stealing information, terminating antivirus applications, and mass mailing.

Domains

Advertisements

Gh0st

Gh0st is a RAT used to control infected endpoints. Gh0st is dropped by other malware to create a backdoor into a device that allows an attacker to fully control the infected device.

MD5 Hashes

Gravity RAT

GravityRAT is a RAT that affects Windows, MacOS, and Android. GravityRAT’s abilities include file exfiltration, remote command execution, keystroke logging. screenshot capture, and anti-analysis techniques.

SHA256 Hashes

Jupyter

Jupyter aka SolarMarker, is a highly evasive and adaptive .NET infostealer that is downloaded by leveraging SEO-poisoning to create watering hole sites for the purpose of deceiving unsuspecting users to visit the website and download a malicious document, often a zip or PDF file embedded with a malicious executable. Jupyter primarily targets browser data in browsers such as Chrome, Chromium, and Firefox and has full backdoor functionality.

IPs

LingyunNet

LingyunNet is riskware that utilizes the victim’s system resources.

Domains

Advertisements

Mirai

Mirai is a malware botnet known to compromise Internet of Things (IoT) devices in order to conduct large-scale DDoS attacks. Mirai is dropped after an exploit has allowed the attacker to gain access to a machine.

IPs

SHA256 Hashes

NanoCore

NanoCore is a RAT spread via malspam as a malicious Excel XLS spreadsheet. As a RAT, NanoCore can accept commands to download and execute files, visit websites, and add registry keys for persistence.

Domains

SHA256 Hashes

QakBot

QakBot is a multifunctional banking trojan that targets financial information, moves laterally across networks, and provides access to other malware, including ransomware. It is spread via malspam that often leverages thread hijacking.

IPs

SHA256 Hashes

MD5 Hashes

Advertisements

RecordBreaker

RecordBreaker is an infostealer that is the successor to Racoon Stealer. RecordBreaker is sold as malware-as-a-service on underground forums, and it steals data such as passwords, cookies, browser data, etc.

IPs

RedLine

RedLine is an infostealer available for purchase on cyber-criminal forums. Campaigns, targets, infection vectors and capabilities vary based on the version purchased. The malware typically targets information that can be easily monetized, such as credentials, cookies, banking information, and cryptocurrency wallet information. Additionally, the malware gathers information about the infected system such as web-browser, FTP clients, instant messengers, VPN services, and gaming clients.  Furthermore, RedLine has remote functionality allowing it to download further malicious tools or drop

IPs

SHA256 Hashes

Shlayer

Shlayer is a downloader and dropper for MacOS malware. It is primarily distributed through malicious websites, hijacked domains, and malvertizing posing as a fake Adobe Flash updater.

All Shlayer domains follow the same pattern <api.random_name.com>. Below area several examples of domains Shlayer uses.

Domains

SHA256 Hashes

Snugy

Snugy is a PowerShell-based backdoor allowing the attacker to obtain the system’s hostname and to run commands. This backdoor communicates through a DNS tunneling channel on the compromised server.

SHA256 Hashes

6c13084f213416089beec7d49f0ef40fea3d28207047385dda4599517b56e127

SocGholish

SocGholish is a downloader written in JavaScript that is distributed through malicious or compromised websites. It uses fake updates, such as Flash Updates or browser updates. SocGholish has been known to use Cobalt Strike and steal information. Additionally, it has been known to lead to further malware infections, such as Azorult, Dridex, NetSupport RAT, and sometimes ransomware.

Domains

Advertisements

TeamSpy

TeamSpy is spyware that has been known to use a popular remote access tool, TeamViewer, and malware to steal information from victims.

IPs

Domains

Ursnif

Ursnif, also known as Gozi or Dreambot, is a banking trojan that is spread through malspam with a Microsoft Office document attached or a ZIP file containing an HTA file. Ursnif collects victim information from cookies, login pages, web forms. Additionally, Ursnif’s web injection attacks include TLS callbacks in order to obfuscate against anti-malware software.

Domains

IPs

ZeuS

 ZeuS is a modular banking trojan which uses keystroke logging to compromise victim credentials when the user visits a banking website. Since the release of the ZeuS source code in 2011, many other malware variants have adopted parts of its codebase, which means that events classified as ZeuS may be other malware using parts of the ZeuS code.

IPs

MD5 Hashes

Exit mobile version