CryptBot

A C++ stealer distributed widely in bundle with other software.

CryptBot Payload

Modifies Windows Defender Real-time Protection settings

Process spawned unexpected child process

This typically indicates the parent process was compromised via an exploit or macro.

RedLine

RedLine Stealer is a malware family written in C#, first appearing in early 2020.

RedLine Payload

SmokeLoader

Modular backdoor trojan in use since 2014.

Vidar

Vidar is an infostealer based on Arkei stealer.

suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil

suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil

Vidar Stealer

ASPack v2.12-2.42

Detects executables packed with ASPack v2.12-2.42

Downloads MZ/PE file

Executes dropped EXE