Research | WeLiveSecurity

Research

Expert content, for researchers by researchers

Research

New Hesperbot targets: Germany and Australia

In September we informed about a new banking trojan called Hesperbot (detected as Win32/Spy.Hesperbot). The perpetrators responsible for the threat are still active – November has been particularly eventful. In this post, we’ll give an update on the situation and malware developments.

Chronology of a Skype attack

By the middle of May, users around the world started to receive messages from their contacts through different instant-messaging applications, such as Skype and Gtalk - an attack that showed off how age-old techniques can ensnare thousands of users. Here, we analyze this attack.

Nymaim: Browsing for trouble

We have already discussed how a system gets infected with Win32/Nymaim ransomware. In this blog post, we reveal a new infection vector, a study of the different international locker designs and ransom prices as well as a complete technical analysis of its communication protocol.

Win32/KanKan – Chinese drama

In this blog post, we will describe software detected by ESET products as Win32/Kankan, and explain why its discovery shocked many Chinese users, then we will provide an in-depth analysis of its functionalities - and discuss the evidence that Xunlei Networking Technologies is implicated.

Filecoder: Holding your data to ransom

Trojans that encrypt user files and try to extort a ransom from the victim in exchange for a decryptor utility are nothing new. We’ve noted a significant increase in Filecoder activity over the past few summer months - in this blog post we address the questions we’re getting about this issue.

Hesperbot – Technical analysis part 1/2

Win32/Spy.Hesperbot is a new banking trojan that has been targeting online banking users in Turkey, the Czech Republic, Portugal and the United Kingdom. For more information about its malware spreading campaigns and victims, refer to our first blog post. In this post we’ll cover the technical details of the malware, including the overall architecture, as well as the mobile component.

Nymaim – obfuscation chronicles

We look at malware delivered by a campaign that has infected thousands of websites around the world - and the various control flow obfuscation techniques that make its analysis as interesting as it is challenging.