Raccoon

Simple but powerful infostealer which was very active in 2019.

RedLine

RedLine Stealer is a malware family written in C#, first appearing in early 2020.

RedLine Payload

ServHelper

ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.

SmokeLoader

Modular backdoor trojan in use since 2014.

Suspicious use of NtCreateProcessExOtherParentProcess

suricata: ET MALWARE ServHelper CnC Inital Checkin

suricata: ET MALWARE ServHelper CnC Inital Checkin

suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Grants admin privileges

Uses net.exe to modify the user's privileges.

Blocklisted process makes network request

Downloads MZ/PE file

Executes dropped EXE

Modifies RDP port number used by Windows

Possible privilege escalation attempt

Sets DLL path for service in the registry

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.