Check Point May 2019 Top 10 malware in Greece

Check Point Research, the research division of Check Point Software Technologies Ltd., has published its latest Global Threat Catalog for May 2019.

The map also contains the most widespread malware threats detected in Greece in May 2019.

AgentTesla – AgentTesla is a sophisticated RAT that functions as a keylogger and password stealer, infecting computers since 2014. AgentTesla has the ability to monitor and collect the victim’s keyboard and system clipboard entries, take screenshots, and extract credentials from software installed on the victim’s machine (including Google Chrome, Mozilla Firefox, and the Microsoft Outlook email client). AgentTesla is sold as a legitimate RAT with interested parties paying $15 – $69 for a user license.

JSEcoin – JavaScript production software that can be embedded into websites. With JSEcoin, you can run production software directly in your browser in exchange for an ad-free browsing experience, game coins, and other incentives.

Lokibot – Lokibot is information-sniffing software that is primarily spread through phishing emails and is used to steal data such as email credentials, as well as passwords to cryptocurrency wallets and FTP servers.

Trickbot – Trickbot is a variant of Dyre that appeared in October 2016. Since then, it has mainly targeted banking users in Australia and the United Kingdom, and has recently started appearing in India, Singapore, and Malaysia.

Cryptoloot – Cryptocurrency mining software that uses the victim's CPU or GPU power and existing resources to mine cryptocurrency – adding transactions to the blockchain and generating new coins. Competes with Coinhive.

Ramnit – Ramnit is a worm that infects and spreads primarily through removable drives and files uploaded to public FTP services. The malware creates a copy of itself to infect removable and permanent drivers. The malware also acts as a backdoor.

Emotet – A sophisticated, self-replicating modular trojan. Emotet was once a banking account stealing Trojan and has recently been used to distribute other malware or in malware distribution campaigns. It uses multiple evasion methods and techniques to persist on a system and evade detection. It can also be spread through unsolicited phishing emails that contain attachments or links with malicious content.

XMRig – XMRig is an open source CPU mining software used for the Monero cryptocurrency mining process and was first seen in circulation in May 2017.

Nivdort – Nivdort is a family of Trojan software that targets the Windows platform. It collects passwords and system information or settings such as Windows version, IP address, software configuration, and approximate location. Some versions of this malware collect keystrokes.

AZORult – AZORult is a trojan that collects and removes data from the infected system. Once the malware is installed on a system (usually delivered by an exploit kit like RIG), it can send saved passwords, local files, crypto wallets, and computer profile information to a remote command & control server.

Check Point's Global Threat Impact Index and ThreatCloud Map are based on Check Point's ThreatCloud intelligence, the largest collaborative network for combating cybercrime, which provides data on threats and attack trends, leveraging a global network of threat detectors.

The ThreatCloud database includes more than 250 million addresses analyzed for bot detection, more than 11 million malware signatures, and more than 5.5 million infected websites, while identifying millions of types of malware every day.

_________________________

• Check Point The most widespread malware for May
• Pale Moon Archive Server with Malware Dropper since 2017
• Windows 10 20H1 build 18932 new ISO from Microsoft
• Microsoft: telemetry in Windows security update files