Check Point Greece June 2019 the most widespread malware

Check Point Research , in addition to the Global Threat List for June 2019, also published the 10 most prevalent threats in Greece for the same month .

Let's look at them in detail:

Hawkeye – Hawkeye is a malicious Info Stealer , which was primarily designed to extract user credentials from infected Windows platforms . In recent months, Hawkeye has been enhanced to include keylogging capabilities in addition to stealing email and web browser passwords . It is often marketed as MaaS (Malware as a Service) through various infection chain techniques.

JSEcoin – JavaScript mining software that can be embedded into websites. With JSEcoin, you can run mining software directly in your browser in exchange for an ad-free browsing experience, in-game coins, and other incentives.

Trickbot – Trickbot is a variant of Dyre that appeared in October 2016. Since then, it has mainly targeted banking users in Australia and the United Kingdom, and has recently started appearing in India, Singapore, and Malaysia.

Lokibot – Lokibot is information-sniffing software that is primarily spread through phishing emails and is used to steal data such as email credentials, as well as passwords to cryptocurrency wallets and FTP servers.

XMRig – XMRig is an CPU mining used for the Monero cryptocurrency mining process and was first seen in circulation in May 2017.

AZORult – AZORult is a trojan that collects and removes data from the infected system. Once the malware is installed on a system (usually delivered by an exploit kit like RIG), it can send saved passwords, local files, crypto wallets, and computer profile information to a remote command & control server.

FormBook – FormBook is an InfoStealer targeting the Windows operating system and was first detected in 2016. It is advertised on hacking forums as a tool that has strong evasion techniques and relatively low prices. FormBook collects credentials from various web browsers and screenshots, monitors and records keystrokes, and can download and execute files according to C & C instructions given to it.

NanoCore – NanoCore is a remote access trojan, first observed in 2013, targeting Windows users. All versions include features such as screen recording, cryptocurrency mining, remote control, and more.

Emotet – A sophisticated, self-replicating modular trojan. Emotet was once a banking account stealing Trojan and has recently been used to distribute other malware or in malware. It uses multiple evasion methods and techniques to persist in the system and evade detection. It can also be spread through unsolicited phishing emails that contain attachments or links with malicious content.

Cryptoloot – Cryptocurrency mining software that uses the victim's CPU or GPU power and existing resources to mine cryptocurrency – adding transactions to the blockchain and generating new coins. Competes with Coinhive.

Check Point Threat Prevention Resources are available on the following website:

http://www.checkpoint.com/threat-prevention-resources/index.html