BitRAT

BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

BitRAT Payload

Raccoon

Simple but powerful infostealer which was very active in 2019.

RedLine

RedLine Stealer is a malware family written in C#, first appearing in early 2020.

RedLine Payload

SmokeLoader

Modular backdoor trojan in use since 2014.

Tofsee

Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

Windows security bypass

suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)

suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)

suricata: ET MALWARE Win32.Raccoon Stealer Data Exfil Attempt

suricata: ET MALWARE Win32.Raccoon Stealer Data Exfil Attempt

xmrig

XMRig is a high performance, open source, cross platform CPU/GPU miner.

Identifies VirtualBox via ACPI registry values (likely anti-VM)

XMRig Miner Payload

Blocklisted process makes network request

Creates new service(s)

Downloads MZ/PE file

Executes dropped EXE

Modifies Windows Firewall

Sets service image path in registry