General: posts

8 Octporterneuman.mx: PowerShell and JavaScript files tied to the AveMaria remote access trojan, and what to do

8 Octdonutclientsmods.xyz: fake DonutSMP Minecraft mods tagged SilentNet, and what to do if you ran one

8 Octsqpengg.com: a server handing out crypted PowerShell scripts, and what to do if one ran on your PC

8 Octdonutsmpcheats.org: fake Minecraft cheat mods with the SilentNet stealer, and what to do if you installed one

8 Octmaciejbi.hosting24.pl: a hosting subdomain that served Remcos scripts and a stego picture, and what to do if your PC fetched them

8 Oct87130921-60-20220830152356.webstarterz.com: an open folder serving Formbook and XWorm PowerShell scripts, and what to do if one ran

8 Octficus.in: picture files hiding the Remcos remote access trojan, and what to do if a script fetched them

8 OctOpenDrive virus: why web.opendrive.com shows up in malware alerts, and what to do if a file from it installed Remcos