Heisenberg RAT is a Remote Access Trojan (RAT) that forms the centerpiece of the Heisenberg malware platform - a modular Windows toolkit sold to other criminals. Alongside the RAT, the platform bundles an information stealer, a loader, a dropper, a cryptor, a packer, a file manager, dual hidden-de
Kreepr is ransomware that our research team discovered while examining new samples submitted to the VirusTotal website. It encrypts victims' files using AES-256-GCM and presents its ransom demands through a pop-up window. Unlike most ransomware, Kreepr provides no contact information of any kind.
PicMo is ransomware our research team discovered during a routine inspection of new malware samples submitted to VirusTotal. It encrypts files on compromised systems, replaces original filenames with randomly generated strings, and appends a shared random extension. The ransom note also threatens
Golden Woolf is ransomware our researchers discovered while inspecting new malware samples submitted to VirusTotal. It encrypts files on the victim's computer, appends the .wolf extension to filenames, and opens a pop-up window with ransom demands. On our test machine, Golden Woolf encrypted file
We have inspected this email and determined it is malspam - a fraudulent message crafted to deliver malware. It poses as a shipping notice from FedEx, claiming that a parcel's customs clearance requires further information. The email has no connection to FedEx whatsoever and should be deleted imme
After inspecting this email, we determined that it is malspam. The message pretends to be a shipment notification from DHL Express, urging recipients to open an attached file that supposedly contains shipping documents. In reality, the attachment is designed to deliver malware, so the email should
After inspecting this email, we determined it is a phishing scam. The message is disguised as a notification from DocuSign, a legitimate electronic signature service, claiming the recipient has a document pending review and signature. Clicking the link inside leads to a fake email login page desig
We have examined this email and concluded it is a phishing scam. It poses as an automated notice from cPanel Webmail support, falsely claiming the recipient must update their email credentials or lose mailbox access. This email should be ignored. The email claims the recipient's mailbox wi
Rokarolla is a banking trojan targeting Android devices. It abuses Accessibility Services to take near-complete control of infected phones and steal banking and cryptocurrency credentials. Rokarolla was first analyzed by Zimperium researchers Vishnu Pratapagiri and Fernando Ortega. In the
CRIMSON is ransomware discovered by our researchers during a routine inspection of new submissions to the VirusTotal website. It encrypts victims' files and demands payment in exchange for decryption. After completing encryption, the ransomware presents its ransom demands in a full-screen message.