While inspecting new submissions to VirusTotal, our research team found yet another ransomware-type program based on Chaos ransomware. This malicious program is called Warlocks, and we released a sample of it on our test system. Afterward, this ransomware encrypted files and appended their filena
While inspecting dubious websites, our researchers discovered the videoplay-on[.]com rogue webpage. It promotes spam browser notifications and redirects users to other (likely untrustworthy and malicious) sites. Most users enter websites of this type through redirects caused by pages using rogue a
Our team has discovered MinimalLight application on a deceptive website claiming that it might be required to add this app to a web browser. After examination, we found that MinimalLight generates advertisements (it functions as adware). It is described as an app providing a dark mode for simple p
Pick Tail is a rogue browser extension that we discovered while inspecting dubious download webpages. After analyzing this piece of software, we determined that it operates as a browser hijacker. Pick Tail alters browser settings to promote the tailsearch.com fake search engine. Additionally, this
Coper is the name of an Android banking Trojan. Our malware researchers discovered that Coper is linked to another Android malware called ExoBotCompat (a reformed version of Exobot). It targets various banking apps. We found that Coper impersonates various banking and utility apps (it uses them as
Lloo is the name of a malicious program within the ransomware classification, which our researchers discovered while inspecting new malware submissions to VirusTotal. Lloo is yet another program belonging to the Djvu ransomware family. After executing a sample of Lloo on our test machine, we lear
After inspecting this email we found that it is a phishing email containing a link that opens a deceptive website asking to provide login credentials. This email is disguised as a letter from an email service provider. It states that incoming messages have been suspended. This email claims
During a routine inspection of new submissions to VirusTotal, our research team discovered the Llee ransomware-type program. We determined that Llee is part of the Djvu ransomware family. Once we launched a sample of Llee on our test machine, it encrypted files and appended their filenames with a
Lltt is ransomware that belongs to the Djvu ransomware family. We discovered it while analyzing malware samples submitted to the VirusTotal site. Lltt encrypts files and appends the ".lltt" extension to their filenames. It also creates a ransom note (the "_readme.txt" file). An example of how Llt
Edw is ransomware that encrypts files, appends the victim's ID, edward22w@aol.com email address, and the ".edw" extension to filenames, and generates two ransom notes (displays a pop-up window and creates a text file named "FILES ENCRYPTED.txt"). We found that Edw belongs to a ransomware family ca