SophosEncrypt is a ransomware-type program that impersonates the Sophos cybersecurity company. It must be emphasized that this data-encrypting malware is in no way associated with the actual Sophos Group plc. On our test system, a sample of SophosEncrypt encrypted files and renamed them following
While examining the Neat Tab browser extension, our team learned that its primary purpose is to force users to use a fake search engine search.neatfor.me. We found that Neat Tab promotes search.neatfor.me by modifying the settings of the affected web browser. Thus, we categorized this app as a bro
During our examination of Protab extension, we learned that it operates as a browser hijacker. The main purpose of this app is to promote search.protab.me, a fake search engine, by changing the settings of a web browser. It is important to note that users often download and add browser hijackers w
PrO is one of the ransomware variants belonging to the Xorist family. Our team discovered PrO while inspecting samples submitted to the VirusTotal website. PrO is designed to encrypt files, append the ".PrO" extension to filenames, and present users with an error window featuring a ransom note. F
Read-the-notification[.]com is a rogue webpage that pushes browser notification spam and can redirect users to different (likely dubious/malicious) sites. Most visitors to this and similar pages access them through redirects generated by websites that employ rogue advertising networks. We discove
Our researchers discovered "Sport background pictures new tab" while investigating untrustworthy websites. This extension displays randomized sports-themed browser wallpapers. After examining this piece of software, we determined that it is a browser hijacker. The "Sport background pictures new t
While investigating new submissions to the VirusTotal site, our research team discovered the Mynvhefutrx malicious program. It is part of the Snatch ransomware family. Malware within the ransomware classification is designed to encrypt files and demand ransoms for their decryption. On our test ma
Our team examined Space Spiders and found that it hijacks a web browser by changing some of its settings to search.spacespiders.net - it promotes a fake search engine. It is common for browser hijackers to be promoted using shady methods. Thus, users often add browser hijackers to their browsers i
While investigating deceptive websites, our researchers discovered an installer containing an application called Subtitles. After inspecting this piece of software, we determined that it is adware. Adware stands for advertising-supported software. Its goal is to generate revenue for its de
Cropsibagen[.]com is a rogue webpage that is designed to push spam browser notifications and redirect visitors to other (likely unreliable/harmful) sites. Users primarily enter cropsibagen[.]com and pages akin to it via redirects generated by websites utilizing rogue advertising networks. Our res