Viruses

Black Hunt is a malicious infection classified as ransomware. Upon infiltration, it begins encrypting data and then blackmails victims into paying for decryption (in #BlackHunt_ReadMe.hta and #BlackHunt_ReadMe.txt ransom notes). While running encryption, the virus also assigns the victim's ID, cybercriminal's email address, and .black extension to influenced files. To illustrate, a file originally named 1.pdf will change to something like 1.pdf.[nnUWuTLm3Y45N021].[sentafe@rape.lol] and acquire the new Black Hunt icon as well. Desktop wallpapers get altered as well. Inside the ransom notes cybercriminals state victims have 14 days to contact them by e-mail and buy a unique key for decryption. Unless the deadline is met, threat actors say they will start selling or leaking the collected data to various third-parties. Victims can review their "data situation" via the provided TOR link.

ScareCrow is a ransomware infection that first appeared on malware radars in 2019. Since then, the ransomware has undergone a couple of insignificant changes and upgrades. For instance, depending on which ScareCrow versions attacked the system, either .scrcrw or .CROW extensions will be assigned to targeted files. Ransomware infections are designed to encrypt potentially valuable data and hold it blocked until victims meet cybercriminals' demands to pay a ransom. ScareCrow uses a combination of AES and RSA cryptographic algorithms to thoroughly encryption of data. After successfully making files inaccessible, the virus automatically opens a pop-up window with decryption instructions. Please note that paying the ransom might not be mandatory - victims are advised to contact reputable ransomware researcher Michael Gillespie and decrypt ScareCrow files for free.

BrasDex is categorized as a banking virus that infects Android (and Windows) devices to access bank accounts and steal money from victims. This specific banker has been observed targeting victims in the Brazilian region - recently via a fake banking app named "Brazilian Banco Santander". Previously, it used to infiltrate devices by disguising itself as essential Android settings applications. BrasDex abuses Accessibility Services to record the information entered into banking applications. However, instead of showing overlaid (fake) screens to bait users into entering their log-in credentials, it instead keyloggers them inside targetted banking applications themselves. Unlike other banking malware, BrasDex also employs an ATS (Automated Transfer System) mechanism, which allows cybercriminals to perform fraudulent transactions in an automated way - therefore automating malicious business and increasing illegal profits. In addition, it is also known that BrasDex exploits a popular Pix fast payment system that was developed by the Central Bank of Brazil. This makes its easier for cybercriminals since all they require is the victim's identifier (which can be an email, CPF, phone number, or random ID). Please note that the Pxi system is not vulnerable - threat actors simply use this system to speed up the process of fraudulent transfers. A lot more technical information about BrasDex can be discovered in this report made by ThreatFabric. BrasDex is a dangerous virus that can cause unpleasant financial losses and privacy issues - thus, make sure to read our guide below and delete this devastating malware from your device. Once done, it is also important to change your log-in credentials.

GodFather is the name of a banking trojan that targets Android devices. Developers behind this malware seek to exfiltrate account credentials and use them for accessing 400+ online banking pages and crypto exchanges across 16 countries worldwide. The GodFather trojan functions by creating overlaid log-in screens and displaying them over legitimate apps or web pages. This way, it tricks users into entering their login data on fake screens, which allows threat actors to access finance-related accounts and abuse them for financial fraud. Before GodFather becomes capable of performing such malicious action, it needs users to allow certain permissions (access to SMS texts and notifications, screen recording, contacts, making calls, recording to external storage, and reading the device status) in the Accessibility Service window. The trojan does it by imitating the legitimate "Google Protect" tool, therefore making the process look ordinary and less likely to trigger suspicion from users. After the permissions are granted, the trojan gets complete liberty to run its malicious actions. GodFather also abuses the granted access to complicate manual removal, steal two-factor authentication codes, process different commands, and hijack data from PIN and password fields. If you want to learn more about the technical specs of GodFather banking trojan, you can check out this page. In summary, GodFather is a highly-devastating infection that can lead to significant financial losses, which is why it must be removed completely and without traces from your device. Use our guide below to do it.

Lucknite (ETH) or LuckniteRansom is a ransomware virus that was recently inspected by malware researchers. The purpose of this malware type is to encrypt potentially important data and hold it hostage until victims pay money for ransom. During encryption, this ransomware also assigns the .lucknite extension to each targeted file. For instance, originally named 1.pdf will change to 1.pdf.lucknite and lose its shortcut icon after encryption. After this, cybercriminals feature decryption instructions in the README.txt note. Sometimes the content of the ransom may vary slightly depending on which ransomware version affected the system.

OBZ is a ransomware-type virus that encrypts access to data and blackmails victims into paying money for decryption. At the time of encryption, the virus alters targeted files with the .OBZ extension. For instance, a file originally named 1.pdf will turn into 1.pdf.OBZ or 1.pdf.obz depending on which ransomware version penetrated the system. In addition, victims also reported seeing a malicious process named Traffic Light in Windows Task Manager. Once the encryption process gets to a close, OBZ Ransomware creates a text document (ReadMe.txt) that features decryption instructions. It is worth noting that the content of this ransom note is identical to other previously discovered U2K and MME ransomware, which may indicate that OBZ was developed by the same group of developers.

CryWiper is a devastating virus that damages the configuration of data to make it inaccessible and then demands money from victims for fake decryption. CryWiper developers disguise their software as ransomware that encrypts data, however, it is in fact a data wiper that simply corrupts the files. While running "encryption", the virus deletes all shadow copies from the root drive and appends the new .CRY extension to highlight the files. For instance, a file originally named 1.pdf will turn into 1.pdf.CRY and become permanently damaged. After this, CryWiper creates a file called README.txt with misleading decryption instructions. It is known that CryWiper avoids damaging .exe, .dll, .lnk, .msi, and .sys files and others stored in Boot, System, and Windows directories. In addition, this virus has also been observed getting distributed via the browserupdate.exe malicious file, programmed in C++ language, and targetting organizations that are localized in Russia.

Beijing is a ransomware-classified infection that encrypts access to data and demands that victims pay money for its decryption. This file encryptor is also likely released by the same cybercriminals who previously developed another ransomware named LeakTheMall. During encryption, victims will see their files change visually - it is the new .beijing that will be eventually added to them. For instance, an originally named 1.pdf will change to 1.pdf.beijing and become no longer accessible. After this, the virus creates text instructions in !RECOVER.txt explaining what should be done to recover the data.