Threat-Hunting Journal April 2022 – Easter Edition

What better way to remember Easter than drawing up a list of the malware Bunny’s most ‘interesting’ offerings? Can you guess who’s the winner of this year’s (malware) egg hunt? If your answer was “trojan” then you’re right – 20 trojan strains for the April 1^st – 28^th interval, totaling over 25,000 positive detections – a 24.24% decrease compared to March. Here’s the April edition of Heimdal™’s threat hunting journal.

Top Malware(s) Detections: 1^st of April – 28^th of April

Throughout April, Heimdal™ Security’s SOC team has detected 20 types of trojans, running up to 25,976 positive detections. As mentioned our threat hunting intro, the value registered for April represents a 24% decrease in trojan-type activity, and compared to the December – March detection interval, it can be considered an all-time historical low (i.e., 28,000 for December vs. 13,751 for January vs. 10,351 for February vs. 33,000 for March). Ranking-wise, TR/CoinMiner.uwtyu raked the most detections (5,555 hits), followed by TR/Spy.Gen8 (4,160 hits), and TR/Rozena.jrrvc (2,717 hits).

As far as distribution is concerned, in April we have more newcomers compared to March, February, and January. To name a few, we have EXP/MS04-028.JPEG.A with 3,112 positive detections, HTML/Infected.WebPage.Gen2 with 1,574 positive detections, HTML/Phish.egr with 1,010 positive detection, and PUA/VyprVPN.Y with 406 positive hits. Here’s the complete list of detections.

Top 9 Malware(s) Detailed

Like always, I’ve included only the most relevant malicious strains, filtering out repeated offenders. Enjoy!

1. TR/Spy.Gen8

A generic-type trojan. It’s usually employed to deliver spyware to the victim’s machine. Depending on the attacker’s motivation, the TR/Spy.Gen8 can be outfitted with various payloads.

2. HTML/Infected.WebPage.Gen2

An attack aimed at infecting commonly used web pages. When the user queries the resource, he or she will often get redirected to an attacker-owned web page for various actions on target (e.g., phishing for credentials, spyware retrieval, etc.)

3. HTML/ExpKit.Gen2

HTML/ExpKit.Gen2 is another moniker for the Brushaloader trojan with RAT (Remote Access Tool) capabilities. It’s typically employed to deliver additional malware to the victim’s machine. HTML/ExpKit.Gen2 is delivered via infected emails, .rar archives, or Visual Basic scripts.

4. ADWARE/ANDR.Boomp.FJAM.Gen

A generic adware-type program that downloads and installs malicious ads on the victim’s Android device.

5. PUA/VyprVPN.Y

A Potentially Unwanted Application (PUA) masquerading as a legitimate VPN-type application. Can be used as an access point or to download additional malicious components.

6. TR/Dropper.VB.Gen

A dropper-type trojan that’s typically employed to drop other malware or components. TR/Dropper.VB/Gen infects its victims via VB scripts.

7. TR/Kryptik.abboik

A trojan that’s used to create a C2 connection via an exploitable backdoor. Kryptik can also be leveraged to download other malware, identify & exploit additional backdoors, typosquatting, and more.

8. TR/Kazy.61783.12

A generic trojan that’s used to deploy and assemble the components of other malware.

10. HEUR/AGEN.1203323

An unknown program that displays potentially malicious behavior.

Additional Cybersecurity Advice and Parting Thoughts

This wraps up the April, post-Easter edition of Heimdal™ Security’s threat hunting journal. Before I go, I’m gonna share with you a couple of advice on how to perk up your security.

• On-demand, auto-scan or disabled. How often should a device be scanned? Should we leave the scanning schedule up to policy, do it ourselves, or give it up for Lent? My advice would be to work out a schedule with your IT admins to find the best time for this type of operation.
• Need more firepower? Perhaps you need more than a virus scan. If so, I would encourage you to try out Heimdal™ Next-Gen AV & MDM, a solution than combines top-tier detection rates, brute-force detection & protection features, and more.
• Phishy emails. No, it’s not a typo. As you know, most malware’s transmitted via email. So, with the risk of sounding like a broken record – if it looks suspicious, it’s probably dangerous.

If you liked this article, follow us on LinkedIn, Twitter, Facebook, Youtube, and Instagram for more cybersecurity news and topics.

Vladimir Unterfingher

Senior PR & Communications Officer

Experienced blogger with a strong focus on technology, currently advancing towards a career in IT Security Analysis. I possess a keen interest in exploring and understanding the intricacies of malware, Advanced Persistent Threats (APTs), and various cybersecurity challenges. My dedication to continuous learning fuels my passion for delving into the complexities of the cyber world.