LoaderBot

LoaderBot is a loader written in .NET downloading and executing miners.

RedLine

RedLine Stealer is a malware family written in C#, first appearing in early 2020.

RedLine Payload

Suspicious use of NtCreateProcessExOtherParentProcess

suricata: ET MALWARE CerberTear Ransomware CnC Checkin

suricata: ET MALWARE CerberTear Ransomware CnC Checkin

xmrig

XMRig is a high performance, open source, cross platform CPU/GPU miner.

XMRig Miner Payload

Downloads MZ/PE file

Executes dropped EXE

VMProtect packed file

Detects executables packed with VMProtect commercial packer.