Threat research notebook
Fresh malware notes, phishing samples, scam redirects, ransomware observations, and field reports from Gridinsoft research. No gallery, no filler: date, case, finding, next read.
310 lab recordsTrojanDownloader:HTML/Elshutilo is script-based malware designed to download additional payloads onto the target system. Since detection is based on threat behavior rather than a signature, it can sometimes result in false positives. Let me explain...
While browsing the Web, you can at some point find yourself with an installer file for...
PUA:Win32/WebCompanion is a Defender detection for Adaware Web Companion or related bundled installs. Remove unwanted browser...
PUA:Win32/DNDownloader is a Microsoft Defender detection for a potentially unwanted downloader or bundled installer. It is...
PUABundler:Win32/MediaGet is a Microsoft Defender detection for MediaGet-related bundled software. MediaGet is commonly associated with torrent/pirated-content workflows and may install extra components or unwanted...
PrimeLookup is a Chrome extension that may unexpectedly appear among your browser's add-ons, causing your search queries to be redirected. As a browser hijacker,...
ZoomFind is a Chrome extension that may unexpectedly appear among the others, causing the browser to redirect your search queries. It belongs to the...
The SwiftSeek is a browser extension that may unexpectedly appear among the others, causing the browser to redirect your search queries. It belongs to...
Trojan:Script/Obfuse!MSR is a generic detection of a malicious script that abuses command interpreters to execute commands or binaries. What distinguishes this threat from others...
Hkbsse.exe is a name of a process related to Amadey Dropper, that you can observe while browsing through the system. This malware delivers other...
Defender found Trojan:Win32/Stealer!MTB or Steanoz.Z!MTB? Keep it quarantined, check if it ran, protect accounts, and scan leftovers.
Trojan:Win32/Commandrob.A!ml is a heuristic detection associated with suspicious network activity. It may refer to a wide range of malicious programs, or be a false...
Azurestaticapps.net is a selection of pages registered on genuine Microsoft hosting, that try scaring the user by false malware infection claims. In fact, it...
Trojan:Win64/Zusy.CZ!MTB is a detection of Microsoft Defender that can flag several different types of malware. Being a heuristic detection, it can as well be...
Sec-tl pop-up ads are malicious push notifications that parasite legitimate browser functionality. Fraudulent actors that stand behind this chain of websites earn money by...
Defender found Trojan:Win32/LsassDump.A? Learn when the LSASS alert may be false positive, when credentials are at risk, and how to clean leftovers with Gridinsoft.
First-tl pop-up ads are malicious push notifications (like a Sec-tl sites) that parasite legitimate browser functionality. Fraudulent actors that stand behind this chain of...
Defender flagged PUABundler:Win32/Rostpay? Learn what it means, why DriverHub or Tesla Browser bundles trigger it, and how to remove leftovers safely.
Altisik Service using high CPU? Learn what AltisikService.exe is, why it returns after ending the task, what files to check, and how to remove...
What does Fauppod!ml mean? Trojan:Win32/Fauppod!ml is a Microsoft Defender machine-learning detection. It does not name one exact malware family; it means the file looks...
