<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>ZeroSecurity &#187; Malware</title>
	<atom:link href="http://zerosecurity.org/category/malware/feed" rel="self" type="application/rss+xml" />
	<link>http://zerosecurity.org</link>
	<description>The Latest Technology News and Tutorials</description>
	<lastBuildDate>Thu, 02 May 2013 05:32:55 +0000</lastBuildDate>
	<language>en-US</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.5.1</generator>
		<item>
		<title>VirusTotal now analyzing Your Network Traffic</title>
		<link>http://zerosecurity.org/malware/virustotal-now-analyzing-your-pcap-files</link>
		<comments>http://zerosecurity.org/malware/virustotal-now-analyzing-your-pcap-files#comments</comments>
		<pubDate>Thu, 02 May 2013 05:31:45 +0000</pubDate>
		<dc:creator>FastFlux</dc:creator>
				<category><![CDATA[Analysis]]></category>
		<category><![CDATA[Malware]]></category>
		<category><![CDATA[Public]]></category>
		<category><![CDATA[google]]></category>
		<category><![CDATA[Malware Analysis]]></category>
		<category><![CDATA[new]]></category>
		<category><![CDATA[Pcap]]></category>
		<category><![CDATA[update]]></category>
		<category><![CDATA[virustotal]]></category>

		<guid isPermaLink="false">http://zerosecurity.org/?p=5161</guid>
		<description><![CDATA[The popular VirusTotal service, which was recently bought out by Google and can run more than 20 anti-virus scanners over a sample in one pass, can now also look for traces of malware infections in captured network traffic. To perform a check, users upload network packets that are captured in the common PCAP format instead of sending VirusTotal the ...]]></description>
		<wfw:commentRss>http://zerosecurity.org/malware/virustotal-now-analyzing-your-pcap-files/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Microsoft Discovers Trojan that hides files to evade analysis</title>
		<link>http://zerosecurity.org/malware/microsoft-discovers-trojan-that-hides-files-to-evade-analysis</link>
		<comments>http://zerosecurity.org/malware/microsoft-discovers-trojan-that-hides-files-to-evade-analysis#comments</comments>
		<pubDate>Sat, 20 Apr 2013 22:42:34 +0000</pubDate>
		<dc:creator>FastFlux</dc:creator>
				<category><![CDATA[Malware]]></category>
		<category><![CDATA[downloader]]></category>
		<category><![CDATA[malware]]></category>
		<category><![CDATA[news]]></category>
		<category><![CDATA[technique]]></category>

		<guid isPermaLink="false">http://zerosecurity.org/?p=5114</guid>
		<description><![CDATA[Microsoft has found an remarkably stealthy Trojan able to delete files it downloads in order to keep them away from forensics detectives and investigators. The Trojan downloader, labeled Win32/Nemim.gen.A, is the most recent model of how malware authors are utilizing advanced techniques to protect their own trade secrets. The Trojan basically makes downloaded component files unrecoverable, so ...]]></description>
		<wfw:commentRss>http://zerosecurity.org/malware/microsoft-discovers-trojan-that-hides-files-to-evade-analysis/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>&#8220;Watering hole&#8221; websites latest attack threat</title>
		<link>http://zerosecurity.org/malware/watering-hole-websites-latest-attack-threat</link>
		<comments>http://zerosecurity.org/malware/watering-hole-websites-latest-attack-threat#comments</comments>
		<pubDate>Wed, 17 Apr 2013 05:39:02 +0000</pubDate>
		<dc:creator>FastFlux</dc:creator>
				<category><![CDATA[Malware]]></category>
		<category><![CDATA[attack]]></category>
		<category><![CDATA[Cyber]]></category>
		<category><![CDATA[malware]]></category>
		<category><![CDATA[threat]]></category>

		<guid isPermaLink="false">http://zerosecurity.org/?p=5081</guid>
		<description><![CDATA[Researchers have found that targeted attacks are on the climb, and that these campaigns have been most effective when cyber gangs first set the bait at popular websites and wait for victims to arrive. Symantec on Tuesday released its “Internet Security Threat Report 2013,” which revealed a 42 percent increase in targeted attacks from 2011 ...]]></description>
		<wfw:commentRss>http://zerosecurity.org/malware/watering-hole-websites-latest-attack-threat/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>New Ransomware Demands $5,000 from victims</title>
		<link>http://zerosecurity.org/malware/new-ransomware-demands-5000-from-victims</link>
		<comments>http://zerosecurity.org/malware/new-ransomware-demands-5000-from-victims#comments</comments>
		<pubDate>Sun, 17 Mar 2013 06:25:37 +0000</pubDate>
		<dc:creator>FastFlux</dc:creator>
				<category><![CDATA[Malware]]></category>
		<category><![CDATA[malware]]></category>
		<category><![CDATA[ransomware]]></category>
		<category><![CDATA[Russia]]></category>

		<guid isPermaLink="false">http://zerosecurity.org/?p=5042</guid>
		<description><![CDATA[Russian anti-virus company Doctor Web has released a warning of an active ransomware effort executed through brute force attack via the RDP protocol on target machines. Once connected to the victim&#8217;s PC, cyber-criminals establish a variant of the ArchiveLock Trojan, which uses the popular archiver, WinRAR to encrypt all files located on the system. &#8220;Trojan.ArchiveLock.20 ...]]></description>
		<wfw:commentRss>http://zerosecurity.org/malware/new-ransomware-demands-5000-from-victims/feed</wfw:commentRss>
		<slash:comments>3</slash:comments>
		</item>
		<item>
		<title>NBC.com Recovering from Citadel Compromise</title>
		<link>http://zerosecurity.org/malware/nbc-com-recovering-from-citadel-compromise</link>
		<comments>http://zerosecurity.org/malware/nbc-com-recovering-from-citadel-compromise#comments</comments>
		<pubDate>Fri, 22 Feb 2013 20:18:52 +0000</pubDate>
		<dc:creator>FastFlux</dc:creator>
				<category><![CDATA[Malware]]></category>
		<category><![CDATA[banking virus]]></category>
		<category><![CDATA[carding]]></category>
		<category><![CDATA[Citadel Trojan]]></category>
		<category><![CDATA[malware]]></category>

		<guid isPermaLink="false">http://zerosecurity.org/?p=4916</guid>
		<description><![CDATA[For a brief time on Thursday, NBC.com, as well as other brand-related domains, were hijacked and used to deliver malware to visitors. The broadcasting corporation is still working to determine how the compromise occurred and how long the malicious code existed on their Web-based properties. The attack against visitors to NBC.com came from Iframes linking to ...]]></description>
		<wfw:commentRss>http://zerosecurity.org/malware/nbc-com-recovering-from-citadel-compromise/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>New VXer malware spreads via BitTorrent</title>
		<link>http://zerosecurity.org/malware/new-vxer-malware-spreads-via-bittorrent</link>
		<comments>http://zerosecurity.org/malware/new-vxer-malware-spreads-via-bittorrent#comments</comments>
		<pubDate>Thu, 21 Feb 2013 05:19:52 +0000</pubDate>
		<dc:creator>FastFlux</dc:creator>
				<category><![CDATA[Analysis]]></category>
		<category><![CDATA[Malware]]></category>
		<category><![CDATA[Bittorrent]]></category>
		<category><![CDATA[china]]></category>
		<category><![CDATA[malware]]></category>
		<category><![CDATA[spread]]></category>
		<category><![CDATA[Vxer]]></category>

		<guid isPermaLink="false">http://zerosecurity.org/?p=4910</guid>
		<description><![CDATA[Malware researchers have started mapping malware samples utilized by Chinese hacking group APT1 to known malware lists. The hackers allegedly attacked establishments including SCADA software outfits Telvent and Digital Bond, and security firm Alient Vault which had links to sensitive information on the US&#8217; defensive readiness versus hacking, according to the report. More than 1000 ...]]></description>
		<wfw:commentRss>http://zerosecurity.org/malware/new-vxer-malware-spreads-via-bittorrent/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Attacks targeting Uyghur Users Researchers Discover</title>
		<link>http://zerosecurity.org/malware/attacks-targeting-uyghur-users-researchers-discover</link>
		<comments>http://zerosecurity.org/malware/attacks-targeting-uyghur-users-researchers-discover#comments</comments>
		<pubDate>Sat, 16 Feb 2013 21:15:29 +0000</pubDate>
		<dc:creator>FastFlux</dc:creator>
				<category><![CDATA[Malware]]></category>
		<category><![CDATA[attack]]></category>
		<category><![CDATA[exploit]]></category>
		<category><![CDATA[kaspersky]]></category>
		<category><![CDATA[malware]]></category>
		<category><![CDATA[Reseachers]]></category>
		<category><![CDATA[Uyghur]]></category>

		<guid isPermaLink="false">http://zerosecurity.org/?p=4883</guid>
		<description><![CDATA[Researchers have discovered a spike in targeted attacks across the past couple of weeks targeting the Uyghur people, a Turkic cultural group established mainly in China and Kazakhstan. The assaults have been exploiting a Microsoft Word vulnerability patched in June 2009, according to a Securelist post by Kaspersky Lab Senior Security Researcher Costin Raiu yesterday. ...]]></description>
		<wfw:commentRss>http://zerosecurity.org/malware/attacks-targeting-uyghur-users-researchers-discover/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Win32/Jabberbot.A uses Jabber Protocol</title>
		<link>http://zerosecurity.org/malware/win32jabberbot-a-uses-jabber-protocol</link>
		<comments>http://zerosecurity.org/malware/win32jabberbot-a-uses-jabber-protocol#comments</comments>
		<pubDate>Sun, 03 Feb 2013 08:23:25 +0000</pubDate>
		<dc:creator>FastFlux</dc:creator>
				<category><![CDATA[Malware]]></category>
		<category><![CDATA[bot]]></category>
		<category><![CDATA[jabber]]></category>
		<category><![CDATA[malware]]></category>
		<category><![CDATA[Malware Analysis]]></category>
		<category><![CDATA[virus]]></category>

		<guid isPermaLink="false">http://zerosecurity.org/?p=4839</guid>
		<description><![CDATA[ESET investigators explain that Jabberbot has been primarily targeting users from Ukraine, but they are uncertain how it’s spreading. For communications, Jabberbot uses one shared account on all the infected hosts, trednet@jabber.ru. Each instance generates one pseudorandom resource identifier, applied by the botmaster to transmit commands with each individual bot. No encryption and no authentication ...]]></description>
		<wfw:commentRss>http://zerosecurity.org/malware/win32jabberbot-a-uses-jabber-protocol/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Fake FedEx Emails lead to Blackhole exploit kit</title>
		<link>http://zerosecurity.org/malware/fake-fedex-emails-lead-to-blackhole-exploit-kit</link>
		<comments>http://zerosecurity.org/malware/fake-fedex-emails-lead-to-blackhole-exploit-kit#comments</comments>
		<pubDate>Wed, 30 Jan 2013 17:15:41 +0000</pubDate>
		<dc:creator>FastFlux</dc:creator>
				<category><![CDATA[Malware]]></category>
		<category><![CDATA[blackhole]]></category>
		<category><![CDATA[exploit]]></category>
		<category><![CDATA[exploit kit]]></category>
		<category><![CDATA[fedex]]></category>
		<category><![CDATA[malware]]></category>
		<category><![CDATA[pack]]></category>
		<category><![CDATA[spread]]></category>

		<guid isPermaLink="false">http://zerosecurity.org/?p=4819</guid>
		<description><![CDATA[Security researchers have revealed a new mass phishing crusade, attached to the Blackhole exploit kit, which is directed at FedEx customers. Symantec and Webroot issued statements supporting they had discovered a large amount of malicious, malware-containing emails taking the form of ffake FedEx receipts. Researcher Shunichi Imano of Symantec writes, &#8220;All the fake FedEx emails delivering ...]]></description>
		<wfw:commentRss>http://zerosecurity.org/malware/fake-fedex-emails-lead-to-blackhole-exploit-kit/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Large Android based botnet built on Backscript Trojan</title>
		<link>http://zerosecurity.org/malware/large-android-based-botnet-built-on-backscript-trojan</link>
		<comments>http://zerosecurity.org/malware/large-android-based-botnet-built-on-backscript-trojan#comments</comments>
		<pubDate>Fri, 25 Jan 2013 04:32:57 +0000</pubDate>
		<dc:creator>FastFlux</dc:creator>
				<category><![CDATA[Malware]]></category>
		<category><![CDATA[Mobile]]></category>
		<category><![CDATA[android]]></category>
		<category><![CDATA[botnet]]></category>
		<category><![CDATA[malware]]></category>
		<category><![CDATA[mobile]]></category>
		<category><![CDATA[virus]]></category>

		<guid isPermaLink="false">http://zerosecurity.org/?p=4758</guid>
		<description><![CDATA[Last week, researchers at Kingsoft Security identified the MDK botnet, which they stated has infected up to one million devices. According to Symantec, an analysis of the code of MDK has shown strong similarities to Android.Backscript, and they use the same certificate to sign APKs (Android Application Packages). Unlike previous versions of the malware however, this ...]]></description>
		<wfw:commentRss>http://zerosecurity.org/malware/large-android-based-botnet-built-on-backscript-trojan/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>
