Loading malware…
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
CitizenLab published their report of the Blackshades RAT used by Syrian Electronic Army against activists.
17 distinct techniques documented for this family, organized by ATT&CK tactic.
“VSCover.exe contains “Libra”… encrypted… Once decrypted, it is loaded as a .NET assembly…” / “encrypted binary and some configuration options.”
The software is broadly classified as malware by most antivirus companies, likely thanks to an advertised feature list that includes dumping the remote computer’s temporary memory; retrieving passwords from dozens of email programs; snarfing the target’s Wi-Fi credentials; and viewing the target’s Webcam.
6 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Commercial RAT used for surveillance/spy capabilities. In this campaign it is delivered via compromised Skype accounts as a .pif lure, drops multiple executables (including VSCover.exe for persistence), creates a keylogger file (data.dat), modifies firewall allow-list registry keys, and connects outbound to a C2 on TCP/4444 (alosh66.myftp.org).
A remote access trojan/spyware used in attacks against Syrian activists.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.