Virus and Spyware Removal Guides, uninstall instructions

What kind of scam is "Coinbase Cashback"?

Our analysis has determined that this is a fraudulent scheme posing as a platform for obtaining reimbursement for transaction fees. Scammers exploit the reputation of a reputable service like Coinbase to deceive individuals into taking actions that could compromise their cryptocurrency wallets.

What kind of malware is Silver?

Silver is a Remote Access Trojan (RAT) written in the C# programming language. This malware enables remote access and control over infected machines. It was first noted in the wild in the autumn of 2023.

The trojan is quite sophisticated and versatile. Silver has a wide variety of functionalities, ranging from causing chain infections to stealing information.

At the time of writing, Silver is actively promoted and sold on various hacker forums and other platforms. Some evidence suggests that the developers of this RAT are based in Syria.

What kind of malware is BaN?

BaN is ransomware belonging to the Xorist family. This variant has been identified during the examination of samples uploaded to VirusTotal. BaN is created to encrypt files. Additionally, BaN appends the ".BaN" extension to filenames, displays, and creates a ransom note (an error message and the "HOW TO DECRYPT FILES.txt" file).

An example of how files encrypted by BaN are renamed: "1.jpg" is changed to "1.jpg.BaN", "2.png" to "2.png.BaN", etc.

What kind of program is SusScrofa?

Upon examining the SusScrofa browser extension, we found that it is an untrustworthy program disseminated through a malicious installer. Its capabilities include activating the "Managed by your organization" feature (in Chrome and Edge), reading and changing data on visited pages, and managing themes and other extensions.

What kind of malware is SparkRAT?

SparkRAT, coded in the Go programming language, is a cross-platform Remote Administration Trojan (RAT) allowing its operators to manage infected devices through a web browser. This RAT encompasses an array of features, such as a process manager, file explorer, desktop monitor, file editor, and other functionalities designed to facilitate comprehensive control over compromised systems.

What kind of application is ToolFrequency?

ToolFrequency has been identified as an ad-supported application. The application bombards users with irritating advertisements, and interacting with these ads might lead users to untrustworthy pages. Moreover, ToolFrequency may possess the ability to gather diverse information.

What kind of scam is "Gasfees Airdrop"?

After reviewing the "Gasfees Airdrop", we determined that it is a cryptocurrency-draining scam. The scheme is presented as an airdrop of the Gwei cryptocurrency, which will supposedly refund the Ethereum Gas that the participant has spent.

It is pertinent to mention that "Gasfees Airdrop" has been noted being promoted by posts on the X (more widely known by its former name – Twitter) social media platform.

What kind of software is HostaSieboldiana?

HostaSieboldiana is a malicious browser extension that our researchers discovered in an installer promoted by a deceptive webpage. This piece of software has a variety of harmful capabilities, including data tracking.

It is noteworthy that setups like the one endorsing this extension can be bundled with additional unwanted and potentially dangerous software.

What kind of email is "Chase Bank Invoice"?

After inspecting this "Chase Bank Invoice" email, we determined that it is spam. It is disguised as an invoice sent by the Chase Bank. The goal is to get recipients to call the fake support line with the intention of reversing the purchase transaction. After calling, the scam aims to deceive victims into disclosing sensitive information and sending money to the scammers. It must be emphasized that this spam mail is in no way associated with the actual JPMorgan Chase Bank, N.A.

What kind of program is PelargoniumHortorum?

Upon inspecting a malicious installer, we discovered an unreliable app called PelargoniumHortorum. We found that this app can read data on all websites, manage themes and extensions within the affected browser, and enable the "Managed by your organization" feature in Chrome and Edge browsers. It is recommended not to trust shady apps with such capabilities.