SWEED

Deceiving the Deceivers: A Review of Deception Pro

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Deceiving the Deceivers: A Review of Deception Pro

INTRINSEC-2025-Threat-Report-Trouble_in_the_air.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor INTRINSEC-2025-Threat-Report-Trouble_in_the_air.pdf

Multi-Stage In-Memory Agent Tesla Campaign Targets LATAM

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Multi-Stage In-Memory Agent Tesla Campaign Targets LATAM

Infostealer Malware FormBook Spread via Phishing Campaign – Part II | FortiGuard Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Infostealer Malware FormBook Spread via Phishing Campaign – Part II | FortiGuard Labs

Infostealer Malware FormBook Spread via Phishing Campaign – Part I | FortiGuard Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Infostealer Malware FormBook Spread via Phishing Campaign – Part I | FortiGuard Labs

Xloader deep dive: Link-based malware delivery via SharePoint impersonation

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Xloader deep dive: Link-based malware delivery via SharePoint impersonation

Malware Analysis - LokiBot

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware Analysis - LokiBot

Cracking Formbook malware: Blind deobfuscation and quick response techniques

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cracking Formbook malware: Blind deobfuscation and quick response techniques

Hiding in Plain Sight: The Subtle Art of Loki Malware’s Obfuscation

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hiding in Plain Sight: The Subtle Art of Loki Malware’s Obfuscation

Exfiltration over Telegram Bots: Skidding Infostealer Logs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Exfiltration over Telegram Bots: Skidding Infostealer Logs

Dissecting Agent Tesla: Unveiling Threat Vectors and Defense Mechanisms | Idan Malihi

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Dissecting Agent Tesla: Unveiling Threat Vectors and Defense Mechanisms | Idan Malihi

Malware Analysis - FormBook

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware Analysis - FormBook

Malware Analysis - Agent Tesla

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware Analysis - Agent Tesla

Foxit PDF “Flawed Design” Exploitation - Check Point Research

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Foxit PDF “Flawed Design” Exploitation - Check Point Research

Stbemu IPTV

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Stbemu IPTV

SteganoAmor campaign: TA558 mass-attacking companies and public institutions all around the world

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor SteganoAmor campaign: TA558 mass-attacking companies and public institutions all around the world

Agent Tesla Targeting United States & Australia: Revealing the Attackers’ Identities

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Agent Tesla Targeting United States & Australia: Revealing the Attackers’ Identities

logpoint-etpr-a-comprehensive-overview-on-stealer-malware-families.pdf

file creation date fromORKL

The original link failed its last check. Original publisher Detailsfor logpoint-etpr-a-comprehensive-overview-on-stealer-malware-families.pdf

logpoint-etpr-a-comprehensive-overview-on-stealer-malware-families-1.pdf?hsLang=en

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor logpoint-etpr-a-comprehensive-overview-on-stealer-malware-families-1.pdf?hsLang=en

Agent Tesla Analysis [Part 2: Deobfuscation]

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Agent Tesla Analysis [Part 2: Deobfuscation]

Spam trends campaigns senior superlatives 2023

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Spam trends campaigns senior superlatives 2023

Malware Analysis — AgentTesla

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware Analysis — AgentTesla

Unfolding Agent Tesla: The Art of Credentials Harvesting. Dropper Analysis

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Unfolding Agent Tesla: The Art of Credentials Harvesting. Dropper Analysis

Proactive response: AnyDesk, any breach - Stairwell

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Proactive response: AnyDesk, any breach - Stairwell

Layers of Deception: Analyzing the Complex Stages of XLoader 4.3 Malware Evolution

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Layers of Deception: Analyzing the Complex Stages of XLoader 4.3 Malware Evolution

Data Insights on AgentTesla and OriginLogger Victims | Bitsight

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Data Insights on AgentTesla and OriginLogger Victims | Bitsight

/var/log/notes

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor /var/log/notes

TLP-CLEAR-20230912-EN-GuLoader-Information-report.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor TLP-CLEAR-20230912-EN-GuLoader-Information-report.pdf

Agent Tesla - Building an effective decryptor

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Agent Tesla - Building an effective decryptor

LokiBot Campaign Targets Microsoft Office Document Using Vulnerabilities and Macros | FortiGuard Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor LokiBot Campaign Targets Microsoft Office Document Using Vulnerabilities and Macros | FortiGuard Labs

[QuickNote] Examining Formbook Campaign via Phishing Emails

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor [QuickNote] Examining Formbook Campaign via Phishing Emails

malware-analysis-writeups/FormBook/FormBook.md at main · itaymigdal/malware-analysis-writeups

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor malware-analysis-writeups/FormBook/FormBook.md at main · itaymigdal/malware-analysis-writeups

Malware-Traffic-Analysis.net - 30 days of Formbook: Day 1, Monday 2023-06-05

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware-Traffic-Analysis.net - 30 days of Formbook: Day 1, Monday 2023-06-05

AgentTesla Malware Analysis - How To Resolve API Hashes With Conditional Breakpoints

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor AgentTesla Malware Analysis - How To Resolve API Hashes With Conditional Breakpoints

XORStringsNet

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor XORStringsNet

March 2023’s Most Wanted Malware: New Emotet Campaign Bypasses Microsoft Blocks to Distribute Malicious OneNote Files

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor March 2023’s Most Wanted Malware: New Emotet Campaign Bypasses Microsoft Blocks to Distribute Malicious OneNote Files

Attack chain leads to XWORM and AGENTTESLA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Attack chain leads to XWORM and AGENTTESLA

Research As A Service | Loginsoft

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Research As A Service | Loginsoft

Xloader | ThreatLabz

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Xloader | ThreatLabz

Emerging Threat: AgentTesla – A Review and Detection Strategies

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Emerging Threat: AgentTesla – A Review and Detection Strategies

IPFS: A New Data Frontier or a New Cybercriminal Hideout?

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor IPFS: A New Data Frontier or a New Cybercriminal Hideout?

XLoader aka FormBook Encryption Analysis, Malware Decryption

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor XLoader aka FormBook Encryption Analysis, Malware Decryption

Following the Scent of TrickGate: 6-Year-Old Packer Used to Deploy the Most Wanted Malware - Check Point Research

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Following the Scent of TrickGate: 6-Year-Old Packer Used to Deploy the Most Wanted Malware - Check Point Research

Sicurezza e trasparenza nei casinò online in Italia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Sicurezza e trasparenza nei casinò online in Italia

https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-onenote-document-leads-to-formbook-malware/

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-onenote-document-leads-to-formbook-malware/

2022-11-21 Threat Intel Report - Malwarebytes Threat Intelligence Report

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor 2022-11-21 Threat Intel Report - Malwarebytes Threat Intelligence Report

Inside the Mind of a ‘Rat’ - Agent Tesla Detection and Analysis | Splunk

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Inside the Mind of a ‘Rat’ - Agent Tesla Detection and Analysis | Splunk

Threat Spotlight: Cyber Criminal Adoption of IPFS for Phishing, Malware Campaigns

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Spotlight: Cyber Criminal Adoption of IPFS for Phishing, Malware Campaigns

2022%20Q3%20Botnet%20Threat%20Update.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2022%20Q3%20Botnet%20Threat%20Update.pdf

Excel Document Delivers Multiple Malware by Exploiting CVE-2017-11882 – Part II | FortiGuard Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Excel Document Delivers Multiple Malware by Exploiting CVE-2017-11882 – Part II | FortiGuard Labs

Mass email campaign with a pinch of targeted spam

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Mass email campaign with a pinch of targeted spam

Excel Document Delivers Multiple Malware By Exploiting CVE-2017-11882 – Part I | Fortinet Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Excel Document Delivers Multiple Malware By Exploiting CVE-2017-11882 – Part I | Fortinet Blog

PrivateLoader: the loader of the prevalent ruzki PPI service

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PrivateLoader: the loader of the prevalent ruzki PPI service

OriginLogger: A Look at Agent Tesla’s Successor

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor OriginLogger: A Look at Agent Tesla’s Successor

PureCrypter is busy pumping out various malicious malware families

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PureCrypter is busy pumping out various malicious malware families

PureCrypter Loader持续活跃，已经传播了10多个其它家族

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PureCrypter Loader持续活跃，已经传播了10多个其它家族

An inside view of domain anonymization as-a-service — the BraZZZerSFF infrastructure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor An inside view of domain anonymization as-a-service — the BraZZZerSFF infrastructure

Resource Center | ConnectWise

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Resource Center | ConnectWise

Malware AV evasion - part 8. Encode payload via Z85 algorithm. C++ example.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware AV evasion - part 8. Encode payload via Z85 algorithm. C++ example.

CERT-UA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CERT-UA

CERT-UA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CERT-UA

Example Analysis of Multi-Component Malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Example Analysis of Multi-Component Malware

Cyble - Xloader Returns with New Infection Technique

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyble - Xloader Returns with New Infection Technique

How to expose a potential cybercriminal due to misconfigurations – CYBER GEEKS

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor How to expose a potential cybercriminal due to misconfigurations – CYBER GEEKS

Secure Communications Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Secure Communications Blog

Secure Communications Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Secure Communications Blog

Harmful Help: Analyzing a Malicious Compiled HTML Help File Delivering Agent Tesla

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Harmful Help: Analyzing a Malicious Compiled HTML Help File Delivering Agent Tesla

Nigerian Tesla: 419 scammer gone malware distributor unmasked

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Nigerian Tesla: 419 scammer gone malware distributor unmasked

Malware development: persistence - part 1. Registry run keys. C++ example.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware development: persistence - part 1. Registry run keys. C++ example.

Reversing a NSIS dropper using quick and dirty shellcode emulation

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Reversing a NSIS dropper using quick and dirty shellcode emulation

Blog |Top 10 Malware March 2022

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Blog |Top 10 Malware March 2022

How to: Detect and prevent common data exfiltration attacks | APNIC Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor How to: Detect and prevent common data exfiltration attacks | APNIC Blog

An AgentTesla Sample Using VBA Macros and Certutil

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor An AgentTesla Sample Using VBA Macros and Certutil

New Formbook Campaign Delivered Through Phishing Emails

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Formbook Campaign Delivered Through Phishing Emails

今さら聞けない！情報窃取型マルウェアの内部動作とJSOCの検知傾向 | LAC WATCH

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 今さら聞けない！情報窃取型マルウェアの内部動作とJSOCの検知傾向 | LAC WATCH

Fake Purchase Order Used to Deliver Agent Tesla | FortiGuard Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Fake Purchase Order Used to Deliver Agent Tesla | FortiGuard Labs

Russia-Ukraine war exploited as lure for malware distribution

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Russia-Ukraine war exploited as lure for malware distribution

Bitdefender Labs Sees Increased Malicious and Scam Activity Exploiting the War in Ukraine

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Bitdefender Labs Sees Increased Malicious and Scam Activity Exploiting the War in Ukraine

Change in Distribution Method of Malware Disguised as Estimate (VBS Script) - ASEC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Change in Distribution Method of Malware Disguised as Estimate (VBS Script) - ASEC

Threat Roundup for February 4 to February 11

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Roundup for February 4 to February 11

XLoader/Formbook Distributed by Encrypted VelvetSweatshop Spreadsheets

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor XLoader/Formbook Distributed by Encrypted VelvetSweatshop Spreadsheets

AgentTesla From RTF Exploitation to .NET Tradecraft

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor AgentTesla From RTF Exploitation to .NET Tradecraft

Catching the RAT called Agent Tesla

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Catching the RAT called Agent Tesla

Weaponization of Excel Add-Ins Part 1: Malicious XLL Files and Agent Tesla Case Studies

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Weaponization of Excel Add-Ins Part 1: Malicious XLL Files and Agent Tesla Case Studies

Infected PowerPoint Files Using Cloud Services to Deliver Multiple Malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Infected PowerPoint Files Using Cloud Services to Deliver Multiple Malware

DTPacker – a .NET Packer with a Curious Password | Proofpoint US

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor DTPacker – a .NET Packer with a Curious Password | Proofpoint US

Xloader | ThreatLabz

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Xloader | ThreatLabz

Deep Analysis Agent Tesla Malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Deep Analysis Agent Tesla Malware

2021 Gorgon Group APT Operation

Malpedia library date Guillaume Orlando fromORKLCCS '25 data

Archived copy on ORKL Detailsfor 2021 Gorgon Group APT Operation

Malware Analysis - AgentTesla v3

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware Analysis - AgentTesla v3

A Tale of Two Dropper Scripts for Agent Tesla

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A Tale of Two Dropper Scripts for Agent Tesla

Do you want your Agent Tesla in the 300 MB or 8 kB package?

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Do you want your Agent Tesla in the 300 MB or 8 kB package?

Agent Tesla Updates SMTP Data Exfiltration Technique

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Agent Tesla Updates SMTP Data Exfiltration Technique

PowerPoint attachments, Agent Tesla and code reuse in malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PowerPoint attachments, Agent Tesla and code reuse in malware

Agent TeslAggah – Malware Book Reports

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Agent TeslAggah – Malware Book Reports

더욱 정교해진 악성 PPT 를 통해 AgentTesla 유포 중 - ASEC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 더욱 정교해진 악성 PPT 를 통해 AgentTesla 유포 중 - ASEC

RATDispenser: Stealthy JavaScript Loader Dispensing RATs into the Wild | HP Wolf Security

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor RATDispenser: Stealthy JavaScript Loader Dispensing RATs into the Wild | HP Wolf Security

Malicious Activity Report - Deep Analysis of a Recent Lokibot Attack

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malicious Activity Report - Deep Analysis of a Recent Lokibot Attack

AgentTesla dropped via NSIS installer

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor AgentTesla dropped via NSIS installer

Advanced Network Detection & Response - MetaDefender NDR - OPSWAT

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Advanced Network Detection & Response - MetaDefender NDR - OPSWAT

Secure Communications Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Secure Communications Blog

FormBook Adds Latest Office 365 0-Day Vulnerability CVE-2021-40444 to Its Arsenal

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor FormBook Adds Latest Office 365 0-Day Vulnerability CVE-2021-40444 to Its Arsenal

Aggah Malware Campaign Expands to Zendesk and GitHub to Host Its Malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Aggah Malware Campaign Expands to Zendesk and GitHub to Host Its Malware

New Campaign Sees LokiBot Delivered Via Multiple Methods

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Campaign Sees LokiBot Delivered Via Multiple Methods

Statically unpacking a simple .NET dropper

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Statically unpacking a simple .NET dropper

Agent.Tesla Dropped via a .daa Image and Talking to Telegram

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Agent.Tesla Dropped via a .daa Image and Talking to Telegram

FormBook Malware Returns: New Variant Uses Steganography and In-Memory Loading of multiple stages to steal data - Home

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor FormBook Malware Returns: New Variant Uses Steganography and In-Memory Loading of multiple stages to steal data - Home

Automation to Combat Evolving Obfuscation – Cipher Tech Solutions, Inc.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Automation to Combat Evolving Obfuscation – Cipher Tech Solutions, Inc.

https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/another-archive-format-smuggling-malware/

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/another-archive-format-smuggling-malware/

Secure Communications Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Secure Communications Blog

尼日利亚黑客组织SWEED正在散发针对物流行业的钓鱼文档 – 绿盟科技技术博客

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 尼日利亚黑客组织SWEED正在散发针对物流行业的钓鱼文档 – 绿盟科技技术博客

Phishing Malware Hijacks Bitcoin Addresses and Delivers New Agent Tesla Variant | FortiGuard Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Phishing Malware Hijacks Bitcoin Addresses and Delivers New Agent Tesla Variant | FortiGuard Labs

Threat Bulletin: Exploring the Differences and Similarities of Agent Tesla v2 & v3

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Bulletin: Exploring the Differences and Similarities of Agent Tesla v2 & v3

Revealing the Snip3 Crypter, a Highly Evasive RAT Loader

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Revealing the Snip3 Crypter, a Highly Evasive RAT Loader

Analysis of top non-HTTP/S threats | Zscaler Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analysis of top non-HTTP/S threats | Zscaler Blog

Deep Analysis: FormBook New Variant Delivered in Phishing Campaign – Part II | FortiGuard Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Deep Analysis: FormBook New Variant Delivered in Phishing Campaign – Part II | FortiGuard Labs

Deep Analysis: New FormBook Variant Delivered in Phishing Campaign – Part I | FortiGuard Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Deep Analysis: New FormBook Variant Delivered in Phishing Campaign – Part I | FortiGuard Labs

Malspam with Lokibot vs. Outlook and RFCs - SANS ISC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malspam with Lokibot vs. Outlook and RFCs - SANS ISC

AgentTesla Malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor AgentTesla Malware

HP_Bromium_Threat_Insights_Report_Q4_2020_V5.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor HP_Bromium_Threat_Insights_Report_Q4_2020_V5.pdf

Cyber Threats 2020: A Year in Retrospect

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber Threats 2020: A Year in Retrospect

AgentTesla Dropped Through Automatic Click in Microsoft Help File

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor AgentTesla Dropped Through Automatic Click in Microsoft Help File

https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-many-roads-leading-to-agent-tesla/

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-many-roads-leading-to-agent-tesla/

Agent Tesla hidden in a historical anti-malware tool

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Agent Tesla hidden in a historical anti-malware tool

Operation Spalax: Targeted malware attacks in Colombia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation Spalax: Targeted malware attacks in Colombia

A Deep Dive into Lokibot Infection Chain

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A Deep Dive into Lokibot Infection Chain

2020: The year in malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2020: The year in malware

Negasteal Uses Hastebin for Fileless Delivery of Crysis Ransomware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Negasteal Uses Hastebin for Fileless Delivery of Crysis Ransomware

Cyber Actors Target K-12 Distance Learning Education to Cause Disruptions and Steal Data | CISA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber Actors Target K-12 Distance Learning Education to Cause Disruptions and Steal Data | CISA

Commodity .NET Packers Uses Steganography Payloads | Proofpoint US

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Commodity .NET Packers Uses Steganography Payloads | Proofpoint US

Inside a .NET Stealer: AgentTesla

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Inside a .NET Stealer: AgentTesla

Aggah Campaign’s Latest Tactics: Victimology, PowerPoint Dropper and Cryptocurrency Stealer

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Aggah Campaign’s Latest Tactics: Victimology, PowerPoint Dropper and Cryptocurrency Stealer

PowerShell Dropper Delivering Formbook - SANS ISC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PowerShell Dropper Delivering Formbook - SANS ISC

COVID19 pandemic is a field day for cybercriminals

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor COVID19 pandemic is a field day for cybercriminals

Interesting FormBook Crypter - unconventional way to store encrypted data

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Interesting FormBook Crypter - unconventional way to store encrypted data

Agent Tesla: A Day in a Life of IR

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Agent Tesla: A Day in a Life of IR

New pastebin-like service used in multiple malware campaigns

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New pastebin-like service used in multiple malware campaigns

Evasive URLs in Spam: Part 2 | Trustwave

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Evasive URLs in Spam: Part 2 | Trustwave

Decrypting AgentTesla strings and config

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Decrypting AgentTesla strings and config

A twisted malware infection chain

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A twisted malware infection chain

Agent Tesla | Old RAT Uses New Tricks to Stay on Top - SentinelLabs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Agent Tesla | Old RAT Uses New Tricks to Stay on Top - SentinelLabs

Gorgon APT targeting MSME sector in India

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Gorgon APT targeting MSME sector in India

2020-q2-spamhaus-botnet-threat-report.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor 2020-q2-spamhaus-botnet-threat-report.pdf

ESET_Threat_Report_Q22020.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ESET_Threat_Report_Q22020.pdf

Revisiting the NSIS-based crypter

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Revisiting the NSIS-based crypter

AgentTesla Delivered via a Malicious PowerPoint Add-In

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor AgentTesla Delivered via a Malicious PowerPoint Add-In

CTNT_Q1_2020_COVID-Report_Final.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor CTNT_Q1_2020_COVID-Report_Final.pdf

Loki Info Stealer Propagates through LZH Files

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Loki Info Stealer Propagates through LZH Files

New AgentTesla variant steals WiFi credentials

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New AgentTesla variant steals WiFi credentials

How Analysing an AgentTesla Could Lead To Attackers Inbox - Part II

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor How Analysing an AgentTesla Could Lead To Attackers Inbox - Part II

Malicious Attackers Target Government and Medical Organizations With COVID-19 Themed Phishing Campaigns

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malicious Attackers Target Government and Medical Organizations With COVID-19 Themed Phishing Campaigns

How Analysing an AgentTesla Could Lead To Attackers Inbox - Part I

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor How Analysing an AgentTesla Could Lead To Attackers Inbox - Part I

Trojan Agent Tesla – Malware Analysis

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Trojan Agent Tesla – Malware Analysis

Navigating Cybersecurity During a Pandemic: Latest Malware and Threat Actors - Cisco Umbrella

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Navigating Cybersecurity During a Pandemic: Latest Malware and Threat Actors - Cisco Umbrella

LokiBot: Getting Equation Editor Shellcode

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor LokiBot: Getting Equation Editor Shellcode

Bitdefender Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Bitdefender Labs

Cyber Crime During the Covid Pandemic | Proofpoint US

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber Crime During the Covid Pandemic | Proofpoint US

(Ab)using bash-fu to analyze recent Aggah sample

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor (Ab)using bash-fu to analyze recent Aggah sample

dissecting the C&C panel deployments

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor dissecting the C&C panel deployments

bayworld-event-cyber-attack-against-foreign-trade-industry

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor bayworld-event-cyber-attack-against-foreign-trade-industry

[CB19] Cyber Threat Landscape in Japan – Revealing Threat in the Shadow by Chi En Shen (Ashley) Oleg Bondarenko

Malpedia library date fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor [CB19] Cyber Threat Landscape in Japan – Revealing Threat in the Shadow by Chi En Shen (Ashley) Oleg Bondarenko

SWEED Targeting Precision Engineering Companies in Italy

date in the CCS '25 data Microsoft fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor SWEED Targeting Precision Engineering Companies in Italy

SWEED Targeting Precision Engineering Companies in Italy

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor SWEED Targeting Precision Engineering Companies in Italy

New WhiteShadow downloader uses Microsoft SQL to retrieve malware | Proofpoint US

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New WhiteShadow downloader uses Microsoft SQL to retrieve malware | Proofpoint US

SELECT code_execution FROM * USING SQLite;

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SELECT code_execution FROM * USING SQLite;

SWEED: Exposing years of Agent Tesla campaigns

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SWEED: Exposing years of Agent Tesla campaigns

SWEED- Exposing years of Agent Tesla campaigns

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor SWEED- Exposing years of Agent Tesla campaigns

Comprehensive Threat Intelligence_ SWEED_ Exposing years of Agent Tesla campaigns

date in the CCS '25 data Cisco fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Comprehensive Threat Intelligence_ SWEED_ Exposing years of Agent Tesla campaigns

RATs and stealers rush through “Heaven’s Gate” with new loader

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor RATs and stealers rush through “Heaven’s Gate” with new loader

FormBook - Hiding in plain sight

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor FormBook - Hiding in plain sight

https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/spammed-png-file-hides-lokibot/

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/spammed-png-file-hides-lokibot/

Virus Bulletin :: VB2018 paper: Inside Formbook infostealer

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Virus Bulletin :: VB2018 paper: Inside Formbook infostealer

2018-R-Jullian-In-depth-Formbook-Malware-Analysis.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2018-R-Jullian-In-depth-Formbook-Malware-Analysis.pdf

Malspam pushing Lokibot malware - SANS Internet Storm Center

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malspam pushing Lokibot malware - SANS Internet Storm Center

Loki Bot: On a hunt for corporate passwords

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Loki Bot: On a hunt for corporate passwords

The Gorgon Group: Slithering Between Nation State and Cybercrime

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Gorgon Group: Slithering Between Nation State and Cybercrime

My Little FormBook

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor My Little FormBook

Analysis of New Agent Tesla Spyware Variant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analysis of New Agent Tesla Spyware Variant

Significant FormBook Distribution Campaigns Impacting the U.S. and South Korea | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Significant FormBook Distribution Campaigns Impacting the U.S. and South Korea | Mandiant

Analyzing the Various Layers of AgentTesla’s Packing

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analyzing the Various Layers of AgentTesla’s Packing

The Formidable FormBook Form Grabber | NETSCOUT

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor The Formidable FormBook Form Grabber | NETSCOUT

In-Depth Analysis of A New Variant of .NET Malware AgentTesla

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor In-Depth Analysis of A New Variant of .NET Malware AgentTesla

Loki-Bot: Information Stealer, Keylogger, and More!

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Loki-Bot: Information Stealer, Keylogger, and More!

Malware-Traffic-Analysis.net - 2017-06-12 - Lokibot infection

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware-Traffic-Analysis.net - 2017-06-12 - Lokibot infection

New Loki Variant Being Spread via PDF File

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Loki Variant Being Spread via PDF File

Loki-Bot: Come out, come out, wherever you are!

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Loki-Bot: Come out, come out, wherever you are!

GitHub - R3MRUM/loki-parse: A python script that can detect and parse loki-bot (malware) related network traffic. This script can be helpful to DFIR analysts and security researchers who want to know what data is being exfiltrated to the C2, bot tracking, etc...

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor GitHub - R3MRUM/loki-parse: A python script that can detect and parse loki-bot (malware) related network traffic. This script can be helpful to DFIR analysts and security researchers who want to know what data is being exfiltrated to the C2, bot tracking, etc...

Nefarious Macro Malware drops “Loki Bot” to steal sensitive information across GCC countries!

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Nefarious Macro Malware drops “Loki Bot” to steal sensitive information across GCC countries!

Agent Tesla Keylogger delivered using cybersquatting | Zscaler

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Agent Tesla Keylogger delivered using cybersquatting | Zscaler