Xllm is ransomware based on the Chaos ransomware. We discovered Xllm while inspecting malware samples submitted to VirusTotal. This ransomware encrypts files, appends the ".xllm" extension to filenames of all encrypted files, and creates a ransom note (the "read_it.txt" file). An example of how f
Hebem is one of the Dharma ransomware variants. Our team discovered Hebem while inspecting malware samples submitted to the VirusTotal website. Hebem encrypts data and appends the victim's ID, hebem@msgsafe.io email address, and ".hebem" extension to the filenames of encrypted files. Also, it disp
Matu is the name of a ransomware variant belonging to the Djvu family. We discovered it while checking the VirusTotal for recently submitted malware samples. Matu encrypts files, appends the ".matu" extension to filenames, and drops the "_readme.txt" file that contains a ransom note. An example o
Reportyourdefenderdata[.]site is the address of a rogue website. Our researchers discovered this page while inspecting suspicious sites. The webpage promotes scams and spam browser notifications. Additionally, reportyourdefenderdata[.]site can redirect visitors to different (likely unreliable/dang
While investigating untrustworthy sites, our research team discovered the Video Finder browser extension. This piece of software claims to allow users to download the videos and images presented on any website. However, our inspection of this extension revealed that it is adware. In other words, V
Our research team discovered the aguhoa[.]com rogue page while inspecting dubious websites. This webpage runs scams, promotes browser notification spam, and redirects users to other (likely deceptive/malicious) sites. Most visitors to webpages like aguhoa[.]com access them via redirects caused by
Zerobot is a piece of malicious software written in the Go programming language. Zerobot has botnet capabilities, which have been observed in use to launch DDoS (Distributed Denial-of-Service) attacks. This program is a cross-platform malware capable of infecting Windows and Linux operating system
After downloading and installing DominantDisplay, we noticed that this app displays unwanted advertisements. Thus, we classified DominantDisplay as adware (advertising-supported software). Our team discovered DominantDisplay while browsing shady websites offering to install software updates, use
During a routine inspection of new malware submissions to VirusTotal, our research team found the Lucknite (ETH) ransomware. Programs within this classification are designed to encrypt data and demand payment for the decryption tools. After being executed on our test machine, Lucknite (ETH) encry
Truebot, also known as Silence.Downloader, is a malicious program that has botnet and loader/injector capabilities. This malware can add victims' devices to a botnet and cause chain system infections (i.e., download/install additional malicious programs/components). There is significant variation