Arkei

Arkei is an infostealer written in C++.

Modifies Windows Defender Real-time Protection settings

Raccoon

Simple but powerful infostealer which was very active in 2019.

RedLine

RedLine Stealer is a malware family written in C#, first appearing in early 2020.

RedLine Payload

ServHelper

ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.

SmokeLoader

Modular backdoor trojan in use since 2014.

Tofsee

Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

Turns off Windows Defender SpyNet reporting

Windows security bypass

suricata: ET MALWARE Amadey CnC Check-In

suricata: ET MALWARE Amadey CnC Check-In

suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)

suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)

suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

suricata: ET MALWARE Win32.Raccoon Stealer Data Exfil Attempt

suricata: ET MALWARE Win32.Raccoon Stealer Data Exfil Attempt

xmrig

XMRig is a high performance, open source, cross platform CPU/GPU miner.

Arkei Stealer Payload

Grants admin privileges

Uses net.exe to modify the user's privileges.

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Nirsoft

XMRig Miner Payload

Blocklisted process makes network request

Creates new service(s)

Downloads MZ/PE file

Executes dropped EXE

Modifies RDP port number used by Windows

Modifies Windows Firewall

Sets DLL path for service in the registry

Sets service image path in registry

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.