While inspecting malware samples submitted to the VirusTotal page, our team discovered ransomware called Bydes. After analysis, we found that Bydes encrypts files, copies every encrypted file and appends the ".bydes" extension to its filename, and displays a pop-up window containing a ransom note.
Our research team discovered the advnotlab[.]com rogue site during a routine inspection of untrustworthy webpages. Advnotlab[.]com operates by promoting browser notification spam and redirecting visitors to different (likely unreliable/malicious) websites. Users typically enter sites of this kind
Defenderweb[.]xyz is a rogue webpage that we found while inspecting questionable sites. It is designed to load deceptive content (scams), promote spam browser notifications, and redirect visitors to different (likely unreliable/malicious) websites. Most users access pages like defenderweb[.]xyz t
Mycomputerads[.]com is a rogue webpage that our researchers discovered while inspecting unreliable sites. It is designed to push spam browser notifications and redirects visitors to other (likely untrustworthy/malicious) websites. Users typically access such pages via redirects caused by sites usi
During a routine inspection of new malware submissions to VirusTotal, our researchers discovered the lXXwXXXNQ ransomware. Once this malicious program was executed on our test machine, it encrypted files and appended their filenames with a ".lXXwXXXNQ" extension. For example, a file originally ti
While inspecting untrustworthy websites, our researchers discovered the protectpcscan[.]com scam site. It is a fake McAfee website. This fraudulent page is presented as the "official" site of McAfee anti-virus. It must be emphasized that this scam webpage is in no way associated with the McAfee Co
While inspecting dubious websites, our researchers discovered the save-your-time[.]com rogue page. It is designed to load deceptive content, push browser notification spam, and redirect visitors to other (likely untrustworthy/malicious) sites. Users typically enter these webpages via redirects cau
Securtytrk[.]xyz uses scare tactics to trick visitors into believing that their computers are infected. It runs the "Keep Your PC Updated With Norton!" scam. Additionally, securtytrk[.]xyz asks for permission to show notifications. Our team discovered this page while inspecting other dubious pages
Settings is the name of an application that we have discovered after downloading software from a shady website and cracked software distribution page. During the analysis, we found that it runs in the Task Manager as "Settings software Copyright © 2021" (the process name may vary). The purpose of
ChromeLoader was first analyzed by x3ph, and later dubbed by G-Data researchers as Choziosi loader. This malware is designed to install malicious extension(s) onto browsers. Currently, two distinct variants of ChromeLoader have been detected - one targeting Windows Operating Systems and another -