Reddit NetSec

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

CIRCL OSINT Feed

ThreatFox MISP Feed

CVE Database V5

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The threat identified as "Kronos Reborn" is a malware classified as a banker Trojan, linked to the Kronos malware family and associated with the Smoke Loader malware delivery framework. Kronos is known for its capability to steal banking credentials by injecting malicious code into web browsers and intercepting user input, primarily targeting online banking sessions. The "Reborn" designation suggests this is a variant or resurgence of the original Kronos malware. While the provided data lacks detailed technical specifics such as affected versions or exploitation vectors, the association with Smoke Loader indicates that the malware is distributed via a loader that facilitates the delivery of additional payloads, enabling modular and persistent infection. The threat level is indicated as low, with no known exploits in the wild at the time of reporting (2018). The malware operates as a trojan, implying it masquerades as legitimate software or is delivered through social engineering tactics. The lack of patch links and CWE identifiers suggests no direct software vulnerability exploitation but rather a malware infection relying on user interaction or phishing. The malware's primary goal is credential theft, which can lead to financial fraud and unauthorized access to sensitive banking information.

Detailed information about OSINT - Kronos Reborn. Get real-time updates, technical details, and mitigation strategies.

OSINT - Kronos Reborn - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - Kronos Reborn

Talos Blog - Smoking Guns - Smoke Loader learned new tricks

Smoke Loader is a well-known modular malware loader that has been actively used by threat actors to deliver various payloads, including banking trojans like TrickBot. The blog referenced, "Talos Blog - Smoking Guns - Smoke Loader learned new tricks," indicates that Smoke Loader has evolved with new capabilities, enhancing its evasion and persistence techniques. Although specific technical details are limited in the provided information, the association with TrickBot and shellcode malware families suggests that Smoke Loader continues to serve as a delivery mechanism for sophisticated malware campaigns. Its modular nature allows attackers to update payloads dynamically, making detection and mitigation more challenging. The malware typically employs shellcode injection techniques to execute malicious code stealthily within compromised systems. Despite the absence of known exploits in the wild at the time of the report, the medium severity rating reflects the potential risk posed by its evolving capabilities and its role in facilitating further infections.

Detailed information about Talos Blog - Smoking Guns - Smoke Loader learned new tricks. Get real-time updates, technical details, and mitigation strategies.

Talos Blog - Smoking Guns - Smoke Loader learned new tricks - Live Threat Intelligence - Threat Radar | OffSeq.com

The threat described is a malware campaign involving a fake job application that includes a macro. Such attacks typically use social engineering to entice victims to open a document, often a Microsoft Office file, which contains embedded macros. When the macro is enabled by the user, it executes malicious code that can download or install malware on the victim's system. The mention of "smoke loader" in the tags suggests that the malware payload may be related to Smoke Loader, a known modular malware downloader and loader used to deliver additional malicious payloads such as ransomware, banking trojans, or other malware families. Although the severity is marked as low and no known exploits in the wild are reported, the presence of macros in job application documents is a common vector for initial compromise in targeted phishing campaigns. The threat level and analysis scores indicate a moderate concern but not an immediate critical risk. The lack of affected versions and patch links suggests this is not a vulnerability in software but rather a malware campaign leveraging social engineering and macro execution. The attack relies heavily on user interaction, specifically enabling macros, which is a common infection vector in phishing and spear-phishing attacks.

Detailed information about Fake Job Application incl. Macro. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'misp-galaxy:tool="smoke loader"'

Filter Threats