Glupteba

Glupteba is a modular loader written in Golang with various components.

Glupteba Payload

MetaSploit

Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

Process spawned unexpected child process

This typically indicates the parent process was compromised via an exploit or macro.

RedLine

RedLine Stealer is a malware family written in C#, first appearing in early 2020.

RedLine Payload

Socelars

Socelars is an infostealer targeting browser cookies and credit card credentials.

Socelars Payload

Suspicious use of NtCreateProcessExOtherParentProcess

Suspicious use of NtCreateUserProcessOtherParentProcess

suricata: ET MALWARE GCleaner Downloader Activity M1

suricata: ET MALWARE GCleaner Downloader Activity M1

suricata: ET MALWARE Generic Password Stealer User Agent Detected (RookIE)

suricata: ET MALWARE Generic Password Stealer User Agent Detected (RookIE)

suricata: ET MALWARE Observed Elysium Stealer Variant CnC Domain (all-brain-company .xyz in TLS SNI)

suricata: ET MALWARE Observed Elysium Stealer Variant CnC Domain (all-brain-company .xyz in TLS SNI)

suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request

suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request

xmrig

XMRig is a high performance, open source, cross platform CPU/GPU miner.

Nirsoft

XMRig Miner Payload

Downloads MZ/PE file

Executes dropped EXE