TF-MAL-py.ares
📛 Threat Title
Malware family: Ares
Description
ThreatFox malware family `py.ares`. Printable name: Ares.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
py.ares
VT: VT base fetch failed: HTTPError: 429 Too Many Requests for domains/py.ares
IOC database
- Type
- domain
- Value
py.ares- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Extracted from Threat TF-MAL-py.ares
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Too Many Requests for domains/py.ares
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:cybernews.com
The FBI warns of a surge in ATM jackpotting attacks, with more than 700 incidents in 2025 alone. Hackers use Ploutus malware to force machines to dispense cash.
-
web:hunt.io
Ares is a banking Trojan designed to steal financial information, including credit card details and banking login credentials. It also installs a stealer targeting browser-stored usernames, passwords, VPN clients, and cryptocurrency wallets. As a variant of the Kronos malware , Ares represents a new wave of sophisticated attacks on financial systems.
-
web:malpedia.caad.fkie.fraunhofer.de
A banking trojan, derived from the source code of win.kronos. In August 2022 it started to incorporate DGA code from win.qakbot.
-
web:medium.com
Persistence: Reinstalls itself even after removal attempts Additional Payloads: Downloads more malware The /tmp/list.txt File This file likely contains: List of files to exfiltrate
-
web:www.breachsense.com
Complete malware remediation now requires addressing both the infected endpoint and the stolen authentication data. Your malware incident response playbook must account for both.
-
web:www.cisa.gov
It highlights technical approaches to uncovering malicious activity and includes mitigation steps according to best practices. The purpose of this report is to enhance incident response among partners and network administrators along with serving as a playbook for incident investigation.
-
web:www.ncsc.gov.uk
How to defend organisations against malware or ransomware attacks.
-
web:www.notebookcheck.net
The FBI issued an IC3 FLASH advisory warning of increased malware -enabled ATM jackpotting in the U.S., naming Ploutus malware , sharing IOCs, and outlining mitigation steps.
-
web:www.pcrisk.com
What is Ares ? Ares is the name of a banking Trojan, a new variant of Kronos. Usually, malware of this type targets login credentials (e.g., usernames, email addresses, passwords), bank account numbers, credit card information, and other financial information. Research shows that Ares is designed to download an information stealer ( Ares Stealer) that collects login credentials from various ...
-
web:www.zscaler.com
Ares is based on the Osiris malware family , which in turn, was forked from the original Kronos banking trojan. Threat actors that utilize Ares had been inactive from approximately March 2022 to June 2022. However, there is a new version of Ares that was released in August 2022 that adds new features.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.