DEV Community: jordanricky1604-ship-it

Malware Deep Dive: Sdbot

jordanricky1604-ship-it — Fri, 17 Jul 2026 12:44:15 +0000

Deep Dive: Sdbot (Rat)

Today we are analyzing the Sdbot malware family, which falls under the Rat category.

Overview

sdbot is classified as a remote access trojan (RAT), malware that gives an attacker remote control of an infected computer. It has one or more associated MITRE ATT&CK technique references (linked on this page) that document the behaviors observed for it. We have not yet published a hand-verified detailed profile for this family; the MITRE references below are the authoritative source for its documented techniques.

Known Aliases

Security vendors and researchers may refer to this family by several different names, including:

win32.sdbot
sdbot.worm
rbot
spybot
sdbot.a

MITRE ATT&CK Techniques

This family has been observed utilizing the following techniques:

T1059.003: View on MITRE
T1071.003: View on MITRE
T1547.001: View on MITRE
T1105: View on MITRE
T1091: View on MITRE
T1498: View on MITRE

Frequently Asked Questions

Where can I learn more about sdbot?
Refer to the linked MITRE ATT&CK technique pages, which document the behaviors associated with this family.

This article is part of the Malware Families Catalog. Visit the original page for more details and interactive data! You can also find the full dataset on Hugging Face and Kaggle.

Malware Deep Dive: Gandcrab

jordanricky1604-ship-it — Tue, 14 Jul 2026 06:54:18 +0000

Deep Dive: Gandcrab (Ransomware)

Today we are analyzing the Gandcrab malware family, which falls under the Ransomware category.

Overview

GandCrab is ransomware that encrypts a victim's files and demands ransom for their return, targeting Windows PCs of both consumers and businesses. Per Malwarebytes, it launched in January 2018 and operated as a ransomware-as-a-service, with affiliates spreading it for a share of the profits. On May 31, 2019 its operators publicly announced they were shutting down. Free decryptors for certain versions were later released through industry and law-enforcement collaboration.

Known Aliases

Security vendors and researchers may refer to this family by several different names, including:

GandCrab

MITRE ATT&CK Techniques

This family has been observed utilizing the following techniques:

T1486: View on MITRE
T1490: View on MITRE
T1082: View on MITRE
T1083: View on MITRE
T1071.001: View on MITRE
T1566.001: View on MITRE

Frequently Asked Questions

What is GandCrab?
Ransomware that encrypts files on Windows PCs and demands payment; it targeted both consumers and businesses.

When was GandCrab active?
It launched in January 2018 and its operators announced a shutdown on May 31, 2019.

How was GandCrab distributed?
As a ransomware-as-a-service: affiliates spread it through methods like exploit kits, phishing, and other vectors in exchange for a cut of the ransoms.

Is there a free GandCrab decryptor?
Free decryptors for certain GandCrab versions were released through industry and law-enforcement collaboration; availability depends on the version.

Should I pay the GandCrab ransom?
Security guidance generally discourages paying. Check whether a free decryptor exists for your version (e.g., via the No More Ransom project) and restore from clean backups where possible.

How can I protect against ransomware like GandCrab?
Keep software patched, be cautious with email attachments and links, use reputable security software, and maintain tested offline backups.

Where can I read an authoritative source on GandCrab?
Malwarebytes maintains a GandCrab overview, linked on this page.

This article is part of the Malware Families Catalog. Visit the original page for more details and interactive data! You can also find the full dataset on Hugging Face and Kaggle.

Malware Deep Dive: Adposhel

jordanricky1604-ship-it — Wed, 08 Jul 2026 08:39:24 +0000

Deep Dive: Adposhel (Adware)

Today we are analyzing the Adposhel malware family, which falls under the Adware category.

Overview

adposhel is classified as adware or a potentially-unwanted program associated with intrusive advertising or bundling. It has one or more associated MITRE ATT&CK technique references (linked on this page) that document the behaviors observed for it. We have not yet published a hand-verified detailed profile for this family; the MITRE references below are the authoritative source for its documented techniques.

Known Aliases

Security vendors and researchers may refer to this family by several different names, including:

adposhel adware
browsefox variant

MITRE ATT&CK Techniques

This family has been observed utilizing the following techniques:

T1176: View on MITRE
T1112: View on MITRE
T1547.001: View on MITRE

Frequently Asked Questions

Where can I learn more about adposhel?
Refer to the linked MITRE ATT&CK technique pages, which document the behaviors associated with this family.

This article is part of the Malware Families Catalog. Visit the original page for more details and interactive data! You can also find the full dataset on Hugging Face and Kaggle.

Malware Deep Dive: Swisyn

jordanricky1604-ship-it — Tue, 07 Jul 2026 08:06:41 +0000

Deep Dive: Swisyn (Trojan_Generic)

Today we are analyzing the Swisyn malware family, which falls under the Trojan_Generic category.

Overview

Executive Summary

Swisyn is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.

Infection Vector and Technical Capabilities

Swisyn is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.

Upon successful execution, Swisyn operates with a focus on stealth and payload delivery:

System Reconnaissance: The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.
Persistence: Swisyn ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.
Payload Delivery: Acting as a downloader, Swisyn receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.

Threat Assessment

A Swisyn infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.

Remediation and Eradication

Endpoint Detection and Response (EDR): Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.
Network Isolation and Sweeps: Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Swisyn executable but also any secondary payloads it may have successfully deployed.
Credential Reset: Because Swisyn frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.

Known Aliases

Security vendors and researchers may refer to this family by several different names, including:

Trojan.Swisyn
Downloader.Swisyn
Win32/Swisyn

MITRE ATT&CK Techniques

This family has been observed utilizing the following techniques:

T1105: View on MITRE
T1547.001: View on MITRE
T1059: View on MITRE

Frequently Asked Questions

Where can I learn more about swisyn?
Refer to the linked MITRE ATT&CK technique pages, which document the behaviors associated with this family.

This article is part of the Malware Families Catalog. Visit the original page for more details and interactive data! You can also find the full dataset on Hugging Face and Kaggle.

Malware Deep Dive: Ldpinch

jordanricky1604-ship-it — Mon, 06 Jul 2026 06:35:23 +0000

Deep Dive: Ldpinch (Unknown)

Today we are analyzing the Ldpinch malware family, which falls under the Unknown category.

Overview

Executive Summary

LDPinch (also known as Pinch) is a legacy, highly successful Information Stealer (InfoStealer) Trojan. While extremely prevalent in the mid-to-late 2000s, its source code has been widely distributed, leading to numerous modern variants. Its primary objective is the rapid, covert extraction of saved passwords, system configurations, and cryptographic keys from an infected Windows host, immediately exfiltrating the data back to the attacker.

Infection Vector and Technical Capabilities

LDPinch is typically distributed via malicious email attachments (often utilizing archive formats like ZIP or RAR to evade basic scanning), disguised as game cracks on P2P networks, or dropped by exploiting unpatched browser vulnerabilities.

Its technical design is focused entirely on fast credential harvesting:

Comprehensive Password Extraction: LDPinch contains specialized modules to decrypt and steal saved credentials from a massive array of software. This includes web browsers (IE, Firefox), email clients (Outlook, The Bat!), FTP clients (CuteFTP, WS_FTP), and instant messaging applications (ICQ, AIM).
System Profiling: Before exfiltration, it gathers a detailed system profile, including installed software, network configuration, and active processes, which is highly valuable to attackers planning subsequent attacks.
Rapid Exfiltration: Unlike a RAT, LDPinch does not typically maintain a long-term interactive session. It is a "smash and grab" tool. It harvests the data, compresses it (often encrypting it), and sends it to the attacker via SMTP (email), FTP upload, or HTTP POST, and then frequently deletes itself to hide its tracks.

Threat Assessment

An LDPinch infection is an immediate data breach. The theft of corporate email, VPN, or FTP credentials provides the attacker with direct, authenticated access to the internal network, bypassing perimeter defenses and paving the way for data extortion or ransomware deployment.

Incident Response and Remediation

Global Credential Reset: The absolute highest priority is a mandatory password reset for all accounts used on the compromised machine. Because it steals FTP and remote access credentials, these must be secured instantly.
Egress Traffic Review: Check firewall logs for anomalous outbound SMTP (Port 25) or FTP (Port 21) connections originating from the infected endpoint, which may indicate where the stolen data was sent.
EDR Sweep: Utilize EDR to ensure the LDPinch executable has been removed. Even if it deleted itself, it is crucial to verify that it did not download a secondary payload before terminating.

Known Aliases

Security vendors and researchers may refer to this family by several different names, including:

InfoStealer.LDPinch
Trojan-PSW.Win32.LdPinch
Pinch

MITRE ATT&CK Techniques

This family has been observed utilizing the following techniques:

T1555: View on MITRE
T1005: View on MITRE
T1048: View on MITRE

Frequently Asked Questions

Where can I learn more about ldpinch?
Refer to the linked MITRE ATT&CK technique pages, which document the behaviors associated with this family.

This article is part of the Malware Families Catalog. Visit the original page for more details and interactive data! You can also find the full dataset on Hugging Face and Kaggle.

Malware Deep Dive: Zbot

jordanricky1604-ship-it — Mon, 06 Jul 2026 06:34:36 +0000

Deep Dive: Zbot (Banking_Trojan)

Today we are analyzing the Zbot malware family, which falls under the Banking_Trojan category.

Overview

Zbot is better known as Zeus, one of the most influential banking trojans in malware history, designed to steal banking information and other sensitive credentials for exfiltration. As MITRE ATT&CK notes for the Zeus Panda variant, the original Zeus source code was leaked in 2011, which let many threat actors build new variants on top of it (including Citadel, Gameover Zeus, and Zeus Panda). It primarily targets Windows and captures credentials through browser-based techniques such as web injection and keylogging.

Known Aliases

Security vendors and researchers may refer to this family by several different names, including:

Zeus
Zbot
Zeus Panda
Wsnpoem

MITRE ATT&CK Techniques

This family has been observed utilizing the following techniques:

T1185: View on MITRE
T1071.001: View on MITRE
T1056.001: View on MITRE

Frequently Asked Questions

What is Zeus/Zbot?
A landmark banking trojan that steals banking credentials and other sensitive data, typically by capturing what victims enter into their browser.

Why is the 2011 Zeus source-code leak important?
MITRE notes the original source code leaked in 2011, allowing threat actors to build many new variants from it, which shaped a whole generation of banking malware.

What variants came from Zeus?
Well-known descendants include Citadel, Gameover Zeus, and Zeus Panda, among others.

How does Zeus steal banking details?
Mainly through browser session hijacking / web injection and keylogging, capturing credentials as they are entered on banking sites.

What systems does Zeus target?
It primarily targets Windows, with the Zeus Panda variant documented across Windows XP through Windows 10.

How did Zeus typically spread?
Historically through phishing emails and drive-by downloads from compromised or malicious websites.

How can I protect financial accounts from trojans like Zeus?
Use multi-factor authentication, keep your system and browser patched, avoid suspicious attachments and links, and monitor accounts for unauthorized activity.

Where is the authoritative reference?
MITRE ATT&CK's Zeus Panda entry (S0330), linked on this page, documents the variant's techniques and the 2011 source leak.

This article is part of the Malware Families Catalog. Visit the original page for more details and interactive data! You can also find the full dataset on Hugging Face and Kaggle.

Malware Deep Dive: Ainslot

jordanricky1604-ship-it — Mon, 06 Jul 2026 06:34:26 +0000

Deep Dive: Ainslot (Trojan)

Today we are analyzing the Ainslot malware family, which falls under the Trojan category.

Overview

Executive Summary

Ainslot is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.

Infection Vector and Technical Capabilities

Ainslot is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.

Upon successful execution, Ainslot operates with a focus on stealth and payload delivery:

System Reconnaissance: The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.
Persistence: Ainslot ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.
Payload Delivery: Acting as a downloader, Ainslot receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.

Threat Assessment

An Ainslot infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.

Remediation and Eradication

Endpoint Detection and Response (EDR): Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.
Network Isolation and Sweeps: Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Ainslot executable but also any secondary payloads it may have successfully deployed.
Credential Reset: Because Ainslot frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.

Known Aliases

Security vendors and researchers may refer to this family by several different names, including:

Trojan.Ainslot
Downloader.Ainslot
Win32/Ainslot

MITRE ATT&CK Techniques

This family has been observed utilizing the following techniques:

T1105: View on MITRE
T1547.001: View on MITRE
T1059: View on MITRE

Frequently Asked Questions

Where can I learn more about ainslot?
Refer to the linked MITRE ATT&CK technique pages, which document the behaviors associated with this family.

This article is part of the Malware Families Catalog. Visit the original page for more details and interactive data! You can also find the full dataset on Hugging Face and Kaggle.

Deep Dive: Xtreme RAT (XTRAT)

jordanricky1604-ship-it — Sat, 04 Jul 2026 11:57:25 +0000

Deep Dive: Xtreme RAT (XTRAT)

Xtreme RAT (also known as XTRAT and ExtRat) is a notorious Windows remote access trojan that has been actively used in targeted cyber-espionage campaigns. Today, we're taking a closer look at this backdoor, its capabilities, and its history.

What is Xtreme RAT?

According to documentation by Malpedia (Fraunhofer FKIE) citing Trend Micro, Xtreme RAT is a backdoor that provides a remote attacker with complete control over an infected system while silently stealing sensitive information.

It is widely known for being deployed in highly targeted attacks. Most notably, it was utilized in the 2012 campaigns against Israeli and Syrian government targets, and cybersecurity researchers have strongly associated the malware family with the Molerats threat actor group.

Core Capabilities

When Xtreme RAT infects a Windows machine, the attacker gains a wide array of capabilities. Some of the primary functions include:

File Management: The ability to silently download, upload, and execute malicious payloads or exfiltrate documents.
Registry Management: Modifying the Windows registry to establish persistence or weaken security settings.
System Control: Executing arbitrary shell commands, forcing system shutdowns, and forcibly logging the user on or off.
Surveillance: Capturing the screen of the infected system and operating as a keylogger to capture passwords, credentials, and other typed information.

Associated Threat Actors & Aliases

Aliases: xtreme rat, xtremerat, xrat, ExtRat
Threat Actor: Molerats
MITRE ATT&CK Techniques: T1059.003, T1056.001, T1113, T1125, T1105, T1071.001

Defense and Mitigation

Detecting Xtreme RAT relies on a combination of endpoint detection and response (EDR) to catch the keylogging and registry modifications, as well as network monitoring to detect the command and control (C2) communication.

By understanding the techniques (such as T1056.001 for Keylogging and T1059.003 for Windows Command Shell), defenders can build robust detection rules to catch the behavior of XTRAT before data exfiltration occurs.

This article is part of the Malware Families Catalog. Visit the original page for more details and interactive data!

I got tired of Ctrl-F'ing PDFs for malware family names so I built a catalog

jordanricky1604-ship-it — Tue, 02 Jun 2026 17:06:16 +0000

Quick backstory. I do MSP work and a chunk of my week is triage. Something pops on an endpoint, you get a family name back from whatever tool flagged it, and now you're trying to figure out if this thing is a banker, a loader, a wiper, ransomware, whatever. Half the time the top Google hit is a vendor blog from 2019 with a popup begging you to download a whitepaper. The other half is some forum thread where the actual useful comment got deleted.

So I made a thing. It's just a static site with one page per malware family. 2,899 of them, pulled from the EMBER 2018 list (Endgame's dataset, the one a lot of ML-for-malware papers train against). Each family gets its own URL like /families/emotet.html, /families/trickbot.html and so on. Nothing fancy. No JS framework. Just HTML you can land on from a search result and read in two seconds.

Live here if you want to poke at it: https://jordanricky1604-ship-it.github.io/malware-families-catalog/

Why bother. Honestly because I kept hitting the same wall. You're on a call, the SOC analyst on the other side says "we're seeing Qakbot", and you want a one-pager you can skim while they keep talking. Not a 40 page report. Not a paywall. Just "here's what this is, here's what it usually does, here's a couple of references." That's the whole pitch.

The other annoying thing was discoverability. If I dump a CSV on HuggingFace nobody searching for a specific family name is going to find it. The CSV is one URL. But if every family is its own page with the name in the title tag and the H1, then someone Googling "what is njRAT" can actually land on it. That was the bet anyway. Still waiting to see how Google feels about it but Bing already indexed ~250 URLs which I'll take.

I also mirrored the dataset to HuggingFace (https://huggingface.co/datasets/Jordan123234/malware-families-catalog) and Kaggle (https://www.kaggle.com/datasets/rickyjordan/malware-families-catalog) because that's where ML folks actually go looking. The GitHub Pages site is the canonical though, the other two are mirrors that point back.

A few things I learned that might save someone else time:

Generating 2,899 HTML files from a template is fine. The slow part isn't the generation, it's getting Pages to actually finish building. I had to split things or it would time out.
Sitemaps matter way more than I expected. I had the pages live for like a week before I realised Search Console wasn't picking them up because my sitemap was only listing the index. Once I generated a proper sitemap with every family URL in it the crawl rate jumped immediately.
Don't name your files with weird characters. Some of the family names in EMBER have slashes, dots, parentheses. I lowercased and stripped everything down to [a-z0-9-] and kept a mapping file. Worth it.
If you cross-link aggressively (A-Z index, related families, prev/next nav) crawlers will actually follow. If you just dump 2,899 orphan pages and pray, they sit there forever.

It's Apache 2.0 so do whatever you want with it. PRs welcome if you want to add a reference or fix a family description, there's a decent chance I got something wrong on a less common one. The build pipeline is in the repo too if you want to fork it for a different taxonomy (CVEs, threat actors, whatever).

That's it. Going back to my actual job now.

I open-sourced a Malware Families Catalog built on EMBER 2018

jordanricky1604-ship-it — Fri, 29 May 2026 23:12:14 +0000

What it is

I just released an open-source dataset that maps EMBER 2018 malware family labels to a unified, structured catalog. It's published identically on three platforms so you can pull it whichever way fits your workflow:

GitHub Pages (canonical): https://jordanricky1604-ship-it.github.io/malware-families-catalog/
HuggingFace: https://huggingface.co/datasets/Jordan123234/malware-families-catalog
Kaggle: https://www.kaggle.com/datasets/rickyjordan/malware-families-catalog

License is Apache-2.0. The schema is identical across all three so you can swap loaders without touching the rest of your pipeline.

Why I built it

The EMBER 2018 benchmark from Elastic is one of the most widely used static-PE malware classification datasets — but the family label column is sparse and noisy, and there's no canonical companion that catalogs which families appear, how often, and what's known about them. Most projects either drop the family labels entirely (and just do benign/malicious classification) or hand-roll their own family lookup table.

I wanted a clean, honest catalog you can join against EMBER without having to do that work yourself.

A few constraints I held myself to while building it:

No fabricated facts. If a family is obscure or unattributed, the record says so. I'd rather have a null than a confident-sounding hallucination.
No manual removal instructions. This is a research dataset, not a how-to. Records describe what a family is and link out to authoritative sources where appropriate.
One schema everywhere. Same columns, same types, same row counts on HF, Kaggle, and GitHub. The README on each platform points at the others.

How to load it

From HuggingFace:

from datasets import load_dataset
ds = load_dataset("Jordan123234/malware-families-catalog")

From Kaggle (via the Kaggle CLI):

kaggle datasets download -d rickyjordan/malware-families-catalog

From GitHub Pages (raw files):

curl -O https://jordanricky1604-ship-it.github.io/malware-families-catalog/data/families.csv

What's next

I'd love feedback — especially from people who've worked with EMBER and have opinions about which family attributes are most useful for downstream classifiers. Open an issue on the GitHub repo if anything looks off.

If you find it useful, a star on the repo helps surface it for the next person searching for the same thing.

— Built and maintained as an open community resource.