Process spawned unexpected child process

This typically indicates the parent process was compromised via an exploit or macro.

RedLine

RedLine Stealer is a malware family written in C#, first appearing in early 2020.

RedLine Payload

VKeylogger

A keylogger first seen in Nov 2020.

VKeylogger Payload

Vidar

Vidar is an infostealer based on Arkei stealer.

suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01

suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01

suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload

suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload

suricata: ET MALWARE Observed Win32/Ymacco.AA36 User-Agent

suricata: ET MALWARE Observed Win32/Ymacco.AA36 User-Agent

suricata: ET MALWARE Win32/Tnega Activity (GET)

suricata: ET MALWARE Win32/Tnega Activity (GET)

Vidar Stealer

ASPack v2.12-2.42

Detects executables packed with ASPack v2.12-2.42

Downloads MZ/PE file

Executes dropped EXE