FlyBox was discovered by 0x0. It renames encrypted files by appending the ".FlyBox" extension. For example, a file named "1.jpg" would change to "1.jpg.FlyBox", "2.jpg" to "2.jpg.FlyBox", etc. Instructions about how to contact the cyber criminals behind FlyBox and pay the ransom are provided in a
"Server Notification" is a spam email campaign. The term "spam campaign" is used to define a large scale operation, during which scam emails are sent by the thousand. There are several, practically identical variants of "Server Notification" emails. These messages claim that additional safety mea
PlusAbout is a rogue application classified as adware. It operates by running intrusive ad campaigns (i.e. it delivers various unwanted and even harmful advertisements). This app also has browser hijacker traits, such as browser settings modification and promotion of bogus search engines. PlusA
Discovered by GrujaRS, Wholocked is malicious software categorized as ransomware. Systems infected with this malware experience data encryption and users receive ransom demands for decryption tools. During the encryption process, all compromised files are appended with the ".wholocked" extension.
FrequencySignal is an adware-type application with browser hijacker traits. It operates by running intrusive advertisement campaigns, makes alterations to browser settings and promotes fake search engines. FrequencySignal promotes Safe Finder via akamaihd.net. Additionally, most adware and brow
Discovered by dnwls0719, IT is a ransomware-type malicious program, named for its use of imagery of the character, Pennywise, The Dancing Clown from the IT film series (2017-2019) based on Stephen King's novel of the same name. This malware is a new variant of Cobra Locker ransomware. The malicio
SoftwareHandler is rogue software categorized as adware and possesses browser hijacker traits. After successful installation, it runs intrusive ad campaigns, modifies browser settings, and promotes bogus search engines. SoftwareHandler promotes Safe Finder through akamaihd.net. Most adware-type
"Universidade de Lisboa" is a spam email campaign designed to spread the LokiBot Trojan. The term "spam campaign" is used to define a large scale operation, during which thousands of deceptive emails are sent. The messages distributed through this spam campaign are in Portuguese and disguised as m
ProductiveOperation is rogue software classified as adware, which also has browser hijacker traits. It runs intrusive advertisement campaigns and modifies browsers to promote fake search engines. ProductiveOperation promotes Safe Finder (via akamaihd.net) in this manner. Due to the dubious met
ScalableSkill is a rogue application classified as adware. It also possesses browser hijacker traits. After successful installation, ScalableSkill operates by delivering intrusive ad campaigns and making alterations to browser settings to promote bogus search engines - it promotes Safe Finder (v