Zendaya is a malicious program belonging to the VoidCrypt ransomware family. Our researchers discovered this program while inspecting new submissions to VirusTotal. After we executed a sample of Zendaya on our test machine, it encrypted files and changed their filenames. Original titles were appe
After inspecting this "People's Postcode Lottery" email, we determined that it is spam. This phishing scam targets personally identifiable information by claiming to be a notification regarding a win in the People's Postcode Lottery - a legitimate lottery in the United Kingdom. However, this lette
While examining batus[.]click, our team learned that it runs the "McAfee - Your Card Payment Has Failed!" scam and wants to show notifications. We discovered batus[.]click while inspecting other shady websites that use rogue advertising networks. It is recommended to ignore sites like batus[.]clic
While analyzing the Snetchball application, we found that it functions as adware - it shows intrusive advertisements. It is common for adware to be promoted and distributed using shady methods. We discovered Snetchball after downloading a malicious installer from an untrustworthy web page.
While inspecting suspicious websites, our researchers found a deceptive page promoting a malicious download assistant. Following installation on our test machine, we learned that it was bundled with a variety of harmful software, including Split Files (alternatively titled Split Files Setup). This
We have discovered the Library Games application after downloading and using a malicious installer. After testing Library Games, we found that it shows intrusive advertisements. Thus, we classified Library Games as adware. This app runs in the Task Manager as Library Games 1.1. Advertiseme
Tanki X is ransomware - malware that blocks access to files by encrypting them. Also, Tanki X appends ".TANKIX" extension to filenames, drops the "READ_ME.txt" file, and displays a pop-up window. Its text file and pop-up window contain a ransom note. An example of how Tanki X renames files: it cha
Desktopanalyticscenter[.]site is the address of a rogue page that we discovered while investigating untrustworthy websites. This site runs scams, promotes spam browser notifications, and redirects visitors to different (likely unreliable/harmful) webpages. Most users access pages like desktopanal
While inspecting suspicious websites, our researchers discovered the Page Downloader browser extension. It is presented as a tool capable of converting webpage content into a single downloadable text file. However, our investigation of Page Downloader revealed that it is adware. Advertisin
Our researchers found the Upsilon ransomware-type program while inspecting new submissions to VirusTotal. It operates by encrypting data in order to demand payment for decryption. On our testing system, Upsilon encrypted files and appended their filenames with a ".upsil0n" extension. For example,