While reviewing new submissions to VirusTotal, our research team discovered the WorldWideProjector application. After analyzing this app, we learned that it operates as adware and belongs to the AdLoad malware family. WorldWideProjector displays ads and may have additional undesirable functional
Viotto is a malicious program classified as a keylogger. The primary functionality of malware within this classification is to log keystrokes (i.e., record keyboard input). However, Viotto has additional spyware/data-stealing capabilities. At the time of research, there were two variants of this p
While checking out suspicious sites that endorse software, our research team discovered the Files Download Enhancer browser extension. It is presented as a download management tool. However, our analysis of this browser extension revealed that it operates as advertising-supported software (adware)
Our research team found the menispirfly[.]com rogue site during a routine inspection of untrustworthy webpages. It is designed to promote browser notification spam, and at the time of research – menispirfly[.]com did so by employing fake CAPTCHA verification. Additionally, this page can redirect v
We have tested goodsearchez.com and found that it is a fake search engine that does not generate unique results. Typically, fake and other untrustworthy search engines are promoted mainly via browser hijackers. Our team also found that goodsearchez.com is promoted via a fake Google Docs extension.
CIA ransomware is a type of malware designed to encrypt data and make ransom demands for the decryption tools. There are two variants of this ransomware. Typically, programs of this kind alter the filenames of encrypted files; however, that is not the case with either of the CIA ransomware version
Our research team discovered yet another malicious program based on the Chaos ransomware titled Teng Snake. Malware within this classification operates by encrypting data and demanding payment for the decryption tools. On our test machine, Teng Snake encrypted files and changed their filenames. O
Xllm is ransomware based on the Chaos ransomware. We discovered Xllm while inspecting malware samples submitted to VirusTotal. This ransomware encrypts files, appends the ".xllm" extension to filenames of all encrypted files, and creates a ransom note (the "read_it.txt" file). An example of how f
Hebem is one of the Dharma ransomware variants. Our team discovered Hebem while inspecting malware samples submitted to the VirusTotal website. Hebem encrypts data and appends the victim's ID, hebem@msgsafe.io email address, and ".hebem" extension to the filenames of encrypted files. Also, it disp
Matu is the name of a ransomware variant belonging to the Djvu family. We discovered it while checking the VirusTotal for recently submitted malware samples. Matu encrypts files, appends the ".matu" extension to filenames, and drops the "_readme.txt" file that contains a ransom note. An example o