Briefing Malware - 01/06/2021

01st of June 2021 - Winners of the 22nd week : njRAT, Redline and Nanocore.

Some links points at extended actionnable intelligence (Threat Bulletins, TTPs, signatures, etc) on our Threat Intelligence Platform Anomali. This access is limited to our clients.

Threat statistics report

Publication date:	01/06/2021
Distribution :	TLP : WHITE

What's new?

Raccoon (NC)

Raccoon, Malware as a Service

Observed since 2019, Raccoon is an information stealer targeting victim credentials and cryptocurrency wallets, widely used for its simplicity.

https://blog.cyberint.com/raccoon-stealer

FormBook (NC)

Lokibot(IDMitre : S0447)

Italian public administrations hit by 34 campaigns

Several campaigns have been detected the last week involving 4 types of malwares (FormBook, Lokibot, Flubot and Adwin). Poste Italiane, Unicredit or ING are amongst the most leveraged phishing themes.

https://www.difesaesicurezza.com/cyber/cybercrime-la-pa-in-italia-attaccata-da-34-campagne-la-scorsa-settimana/

Vidar (NC)

Deep Analysis of Vidar Stealer

Vidar Stealer is a malware specialized in stealing information mainly distributed as spam mail or as a cracked version thanks to a keygen software to license the commercial software

https://medium.com/s2wlab/deep-analysis-of-vidar-stealer-ebfc3b557aed

Download the report

Cookies	Description
Registered visitor cookie	Cookie given to each registered user.
Registered visitor functionality cookie	Cookies used to remember the unique identifier given to each registered user.
Social plug-in content sharing cookie	Cookies set by services such as Facebook Connect or Twitter Button, which allow social networks users to share the content of our websites on social networks.
Unregistered visitor cookie	Cookies used to give to unregistered users a unique identifier in order to recognize them and to analyze how they use the website.
Analytic cookie	Cookies used to store URLs of the previous page visited, enabling to track users navigating from inside or from outside the website. If you click on a Sogeti advertisement on a non-Sogeti website, a cookie may be used to log which website you are on, in order to ensure our advertisements are served effectively and to measure whether our advertisements are viewed. Google Analytics: cookies set by Google analytics are used for web analytical purpose, but are not used to track individual users. For further information on how Google Analytics collects and uses information on our behalf and the right to use such cookies, please refer to the Google Analytics products and services privacy statement. If you object to your Personal Data being collected by Google Analytics, you may download and install the Google Analytics Opt-out Browser Add-on. Pardot: cookies set by Pardot are used to track users on our website. Visits are tracked for known users only. Unknown users are recorded as anonymous users. Please refer to Pardot privacy policy for any further information on their use and your rights related to the use of such cookies.