Detected Djvu ransomware

Djvu Ransomware

Ransomware which is a variant of the STOP family.

Modifies WinLogon for persistence

Modifies Windows Defender Real-time Protection settings

Raccoon

Simple but powerful infostealer which was very active in 2019.

RedLine

RedLine Stealer is a malware family written in C#, first appearing in early 2020.

RedLine Payload

Registers COM server for autorun

SmokeLoader

Modular backdoor trojan in use since 2014.

Suspicious use of NtCreateProcessExOtherParentProcess

Suspicious use of NtCreateUserProcessOtherParentProcess

Tofsee

Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

Turns off Windows Defender SpyNet reporting

UAC bypass

Vidar

Vidar is an infostealer based on Arkei stealer.

Windows security bypass

suricata: ET MALWARE DNS Query Sinkhole Domain Various Families (Possible Infected Host)

suricata: ET MALWARE DNS Query Sinkhole Domain Various Families (Possible Infected Host)

suricata: ET MALWARE Known Sinkhole Response Header

suricata: ET MALWARE Known Sinkhole Response Header

suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request

suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request

suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

xmrig

XMRig is a high performance, open source, cross platform CPU/GPU miner.

Nirsoft

Vidar Stealer

XMRig Miner Payload

Creates new service(s)

Downloads MZ/PE file

Executes dropped EXE

Modifies Windows Firewall

Sets file to hidden

Modifies file attributes to stop it showing in Explorer etc.

Sets service image path in registry

Stops running service(s)