Our inspection of the "Pending Payment" email revealed that it is spam. The fake letter is presented as a final warning regarding a pending payment. This mail aims to lure recipients into following the provided link that leads to the download of a likely malicious file. The scam email with
While examining the Loading Timer browser extension, our team found that it shows unwanted intrusive advertisements. Apps that display ads are categorized as advertising-supported applications. Users rarely download and install (or add) adware knowingly. We discovered multiple deceptive websites p
While inspecting questionable websites, our researchers discovered the alltimetopdefender[.]site rogue webpage. It operates by running scams, promoting browser notification spam, and redirecting visitors to other (likely unreliable/dangerous) websites. Most users access sites like alltimetopdefen
While checking the VirusTotal page for recently submitted samples, our team discovered ransomware dubbed G-Stars. This malware encrypts files to prevent victims from accessing/opening them. Also, G-Stars appends a string of random characters and the ".G-Stars" extension to filenames and drops its
While inspecting dubious websites, our research team discovered a page endorsing the Crypto Currency Converter browser extension. It is presented as a tool that converts cryptocurrencies, thus allowing users to compare conversion rates easily. Our inspection of this piece of software revealed tha
While testing the UniversalSource application, our team noticed that it displays intrusive advertisements. Therefore, we categorized UniversalSource as adware (advertising-supported software). In most cases, users install adware unintentionally. We discovered UniversalSource while inspecting dec
Crustom is a ransomware-type program. It operates by encrypting victims' files to demand ransoms for the data decryption. After we executed a sample of Crustom on our test machine, it encrypted files and changed their filenames. The affected files were renamed with a random character string, e.g.
Bpto is a ransomware variant belonging to the Djvu family. We discovered Bpto while examining malware samples submitted to the VirusTotal page. Bpto encrypts data, appends its extension (".bpto") to filenames, and drops its ransom note (the "_readme.txt" file). An example of how Bpto modifies fil
While inspecting malware samples submitted to VirusTotal, we discovered a Djvu ransomware variant dubbed Bpws. This variant encrypts files and appends the ".bpws" extension to filenames. Also, Bpws drops its ransom note (the "_readme.txt") file. Since Bpws is part of the Djvu ransomware, it may b
While investigating suspicious webpages, our researchers found dozefive[.]xyz. This rogue page is designed to promote scams and browser notification spam. Furthermore, it can redirect users to different (likely unreliable/hazardous) websites. Most visitors to dozefive[.]xyz and webpages akin to i