Threat research notebook
Fresh malware notes, phishing samples, scam redirects, ransomware observations, and field reports from Gridinsoft research. No gallery, no filler: date, case, finding, next read.
302 lab recordsPUABundler:Win32/MediaGet is a Microsoft Defender detection for MediaGet-related bundled software. MediaGet is commonly associated with torrent/pirated-content workflows and may install extra components or unwanted programs. Even when it is not a classic virus, it...
Hkbsse.exe is a name of a process related to Amadey Dropper, that you can observe while...
Defender found Trojan:Win32/Stealer!MTB or Steanoz.Z!MTB? Keep it quarantined, check if it ran, protect accounts, and scan...
Trojan:Win32/Commandrob.A!ml is a heuristic detection associated with suspicious network activity. It may refer to a wide...
Azurestaticapps.net is a selection of pages registered on genuine Microsoft hosting, that try scaring the user by false malware infection claims. In fact, it...
Trojan:Win64/Zusy.CZ!MTB is a detection of Microsoft Defender that can flag several different types of malware. Being a heuristic detection, it can as well be...
Sec-tl pop-up ads are malicious push notifications that parasite legitimate browser functionality. Fraudulent actors that stand behind this chain of websites earn money by...
Defender found Trojan:Win32/LsassDump.A? Learn when the LSASS alert may be false positive, when credentials are at risk, and how to clean leftovers with Gridinsoft.
First-tl pop-up ads are malicious push notifications (like a Sec-tl sites) that parasite legitimate browser functionality. Fraudulent actors that stand behind this chain of...
Defender flagged PUABundler:Win32/Rostpay? Learn what it means, why DriverHub or Tesla Browser bundles trigger it, and how to remove leftovers safely.
Altisik Service using high CPU? Learn what AltisikService.exe is, why it returns after ending the task, what files to check, and how to remove...
What does Fauppod!ml mean? Trojan:Win32/Fauppod!ml is a Microsoft Defender machine-learning detection. It does not name one exact malware family; it means the file looks...
JsTimer is a malicious browser extension detected in various browsers, predominantly targeting users through dubious websites. This extension engages in peculiar behavior by blocking...
Defender found PUA:Win32/GameHack? Check cheat-tool risk, false-positive signs, when not to allow it, and how to remove leftovers safely.
Funny Tool Redirect is a malicious browser extension that you may see installed in your browser. It spreads through dodgy websites and does a...
Win64/Reflo.HNS!MTB is a detection of a malware sample that aims at stealing confidential information. It usually spreads through game mods and works as quietly...
Analysis shows a hike in the number of malicious pop-ups that come from Check-tl-ver websites. It is a rather common strategy of aggressive marketing...
Trojan:PowerShell/CoinStealer.RP!MTB is a detection of Microsoft Defender, that normally flags malware that can steal cryptocurrency wallets. You may see it popping up after downloading...
PUABundler:Win32/DriverPack is potentially unwanted software that claims to install or update drivers. In fact, it floods the system with unwanted software and changes browser...
"Virus Alert (05261)" is a scam pop-up message you can see on a website that looks like a Microsoft page, but with a strange...
