Browse Rules

bankbot_polish_banks [Android]

BankBot/Mazain attacking polish banks

malware_bankshot

Bankshot malware

Shifu_Banking_Trojan_0 [malware]

Detects Shifu Banking Trojan

SHIFU_Banking_Trojan_1 [malware]

Detects SHIFU Banking Trojan

silent_banker [packers]

shylock [malware]

Shylock Banker

andr_sk_bank [Android]

Yara rule for Banking trojan targeting South Korean banks

Hsdfihdf [malware]

Polish banking malware

Shifu_Banking_Trojan [yara]

Detects Shifu Banking Trojan

Tinba2 [malware]

Tinba 2 (DGA) banking trojan

HiddenCobra_BANKSHOT_Gen [yara]

Detects Hidden Cobra BANKSHOT trojan

MALW_trickbot_bankBot [malware]

Detects Trickbot Banking Trojan

crime_win32_hvnc_banker_gen [yara]

Detects malware banker hidden VNC

ice_ix_12xy [malware]

ICE-IX 1.2.x.y trojan banker

banbra [packers]

Banker_Acecard [Android]

Shifu [malware]

zbot [packers]

F&O - Reverted bank account number modifications

Identifies changes to bank account numbers in Finance & Operations, whereby a bank account number is modified but then subsequently reverted a short time later.

Pathlock TDnR - Business Partner Bank Data Changes

Detects changes to bank master data for business partners in SAP, forwarded by Pathlock Threat Detection and Response. Modifications to business partner bank accounts may indicate fraud targeting vendor or customer payments.

Brand impersonation: Silicon Valley Bank

Detects emails that impersonate Silicon Valley Bank

Pathlock TDnR - Bank Master Data Changes

Detects changes to bank master data in SAP, forwarded by Pathlock Threat Detection and Response. Unauthorized modifications to bank data may indicate financial fraud, payment redirection, or business email compromise attacks targeting payment processes.

spyeye [malware]

SpyEye X.Y memory

Brand impersonation: Bank of America

Impersonation of Bank of America, usually for credential theft.

moscow_fake [Android]

Moskow Droid Development