Deed RAT: Predecessor to BLOODALCHEMY
Deed RAT is a remote access tool that serves as the predecessor to BLOODALCHEMY. It is part of the malware lineage that…
Category: Malware
Malware families, payloads, loaders, ransomware and related tooling.
SilentDataCollector: Credential and Data Stealer in StopAndProtect
SilentDataCollector is a stealer component that exfiltrates file lists, specific files, and credentials. It includes a keylogger, WhatsApp data exfiltration, and screenshot…
VBS Spreader: Propagation Module in StopAndProtect
The VBS spreader propagates malware to hard disks and removable media, scans networks, and uses WMI for lateral movement. It is a…
LockScreen: Ransomware Display Module in StopAndProtect
LockScreen blocks user input and displays a ransom message with a payment QR code. It is one of the six components deployed…
SimpleChatProxy: Chat Utility in StopAndProtect
SimpleChatProxy is a custom chat application used by attackers to communicate with victims during the StopAndProtect campaign, likely for negotiation or intimidation.
SilentEncryptor: Ransomware Component of StopAndProtect
SilentEncryptor is a ransomware component used in the StopAndProtect campaign. It encrypts files on infected computers, either all or targeted by hostname,…
NetworkShareScanner: SMB/USB Worm in StopAndProtect
NetworkShareScanner is a worm component that spreads via SMB and USB, allowing lateral movement across networks. It is part of the StopAndProtect…
StopAndProtect Campaign Uses Nearly 2,000 Hacked WordPress Sites to Spread Malware and Steal Data
Cybersecurity researchers have uncovered a global cybercrime operation dubbed 'StopAndProtect' that abuses nearly 2,000 hacked WordPress websites to distribute malware, steal data,…
DEWMODE Web Shell Used by Clop
DEWMODE is a web shell deployed by Clop after exploiting Accellion FTA vulnerabilities. It provides remote access and data exfiltration capabilities.
LEMURLOOT Web Shell Used by Clop
LEMURLOOT is a web shell used by Clop in MOVEit Transfer attacks, enabling credential theft and data exfiltration.