Arkei

Arkei is an infostealer written in C++.

IcedID, BokBot

IcedID is a banking trojan capable of stealing credentials.

RedLine

RedLine Stealer is a malware family written in C#, first appearing in early 2020.

RedLine Payload

SmokeLoader

Modular backdoor trojan in use since 2014.

Suspicious use of NtCreateProcessExOtherParentProcess

Tofsee

Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

Vidar

Vidar is an infostealer based on Arkei stealer.

Windows security bypass

suricata: ET MALWARE Known Sinkhole Response Header

suricata: ET MALWARE Known Sinkhole Response Header

suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

suricata: ET MALWARE Win32/IcedID Request Cookie

suricata: ET MALWARE Win32/IcedID Request Cookie

xmrig

XMRig is a high performance, open source, cross platform CPU/GPU miner.

Arkei Stealer Payload

Core1 .NET packer

Detects packer/loader used by .NET malware.

Vidar Stealer

XMRig Miner Payload

Creates new service(s)

Downloads MZ/PE file

Executes dropped EXE

Modifies Windows Firewall

Sets service image path in registry