AsyncRat

AsyncRAT is designed to remotely monitor and control other computers.

Azorult

An information stealer that was first discovered in 2016, targeting browsing history and passwords.

BitRAT

BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

BitRAT Payload

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Modifies Windows Defender Real-time Protection settings

Oski

Oski is an infostealer targeting browser data, crypto wallets.

suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)

suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil

suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M1

suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M16

Async RAT payload

Downloads MZ/PE file

Executes dropped EXE

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.