After inspecting this "Ledger Firmware Update", we determined that it is a scam. It states that the user's Ledger wallet requires a firmware update. However, once a wallet is exposed to the scam – it begins operating as a cryptocurrency drainer. The Ledger Company is a legitimate business
Dxen is a ransomware-type program discovered by our researchers during a routine investigation of new submissions to VirusTotal. Dxen is part of the Phobos ransomware family. Malware within this category encrypts files and demands payment for the decryption. On our test machine, Dxen encrypted fi
While analyzing malware samples submitted to VirusTotal, we discovered a ransomware variant belonging to the GlobeImposter family, dubbed GoodMorning. Upon infecting a system, GoodMorning initiates file encryption and adds the ".goodmorning" extension to filenames. Additionally, it generates a ran
Our research team discovered the Viewndown application during a routine investigation of questionable sites. The app's promotional material presents it as a tool that allows users to pin a selected window and keep it on top of others. Upon inspection, we determined that Viewndown operates as prox
During our examination of the Brain Gym Pro application, we discovered that it forces users to visit braingympro.com by changing the settings of a web browser. This behavior is known as browser hijacking. In addition to taking control over a browser, Brain Gym Pro may gather various data.
While assessing malware samples uploaded to VirusTotal, we discovered a ransomware variant from the Makop family dubbed Rocklee. This ransomware encrypts data, changes filenames of all encrypted files, and drops a ransom note ("+README-WARNING+.txt"). Rocklee appends the victim's ID, the attacker
Upon our examination, it came to our attention that Searchsit has been crafted to promote searchsit.com. This browser extension achieves its objective by modifying the configurations of a web browser, coercing users to visit searchsit.com. Thus, we have classified Searchsit as a browser hijacker.
When examining malware samples of VirusTotal, we discovered a ransomware variant belonging to the Proton family dubbed SWIFT. Once SWIFT infiltrates a computer, the ransomware encrypts and renames files, changes the desktop wallpaper, and creates a ransom note ("#SWIFT-Help.txt"). SWIFT renames f
While investigating suspicious sites, we discovered the Pinaview application. It is promoted as a tool that allows users to keep (i.e., pin) a window on top of all others. However, this piece of software operates as proxyware – an Internet bandwidth hijacker. It may also have other undesirable or
Asuka is a stealer written in the C++ programming language. It targets sensitive information from browsers, cryptocurrency wallets, and other applications/extensions. The developers of this malware are offering it for sale on the Web. Asuka is sold as a customizable data-stealing program with fea