New WebSockets Backdoor Likely Targeting Iraq
On September 29 2026, @MalwareHunterTeam shared a suspicious low detection file named document.exe, uploaded to VirusTotal from Iraq on that same day. The sample has minimal detection in VirusTotal...
dmpdump
Possible Pakistan-nexus Backdoor Targeting Afghanistan
On August 29, 2026, a ZIP file containing an executable named Special Job Opportunities and Recruitment Information in Various Ministries of Afghanistan.exe and a DLL named dgxi.dll was uploaded to...
Stager Targeting Russian Organization
On July 28, 2026, MalwareHunterTeam shared an interesting sample apparently targeting a Russian speaking victim. The sample caught my attention because I don’t usually come across malware targeting...
Analysis of a Low-Detection Linux Implant with Hands-On Intrusion Capabilities
UPDATE: After reviewing related infra found by @500mk500 and a related sample by @malwrhunterteam, I found quite a few similarities with the Adaptix Agent using the adaptix_gopher protocol. In ear...
Linux Backdoor Targeting iKuai Routers
On July 1, 2026, MalwareHunterTeam shared an ELF uploaded to VirusTotal from Japan with 0 detection. After a quick code inspection, it was evident that the ELF was a backdoor targeting specific Lin...
PulseRAT - Google Sheets-based RAT Using UAE-India Partnership Lure
On May 19, 2026, I came across an interesting ISO uploaded from UAE. The ISO is named UAE-India_Strategic_Partnership_Week.iso, and it is likely related to the defense partnership between India and...
Rebex-based Telegram RAT Targeting Vietnam
On April 1, 2026, a zip archive named CV - Vu PLPC So2156516.zip was uploaded to VirusTotal from Vietnam. This archive contains a Microsoft Compiled HTML (CHM) file named Word Document - CV - Vu PL...
Low Detection Linux and macOS Backdoor
In early March, MalwareHunterTeam shared a hash associated with a Linux backdoor with 0 detection in VirusTotal. It is well known that AV engines in VirusTotal do not implement the full capability ...
Rare Earth Material Lure Delivering Shellcode Loader
On November 21, 2025, Malware Hunter Team shared an interesting sample on X, uploaded to VirusTotal from Singapore. The ZIP file in question is named China’s Governance of Rare Earths and its Globa...
Unknown Malware Using Azure Functions as C2
On August 28, 2025, an ISO named Servicenow-BNM-Verify.iso was uploaded to VirusTotal from Malaysia with very low detections: The ISO image contains 4 files, two of them hidden. servicenow-...