Raccoon

Simple but powerful infostealer which was very active in 2019.

SmokeLoader

Modular backdoor trojan in use since 2014.

Suspicious use of NtCreateProcessExOtherParentProcess

suricata: ET MALWARE ServHelper CnC Inital Checkin

suricata: ET MALWARE ServHelper CnC Inital Checkin

Grants admin privileges

Uses net.exe to modify the user's privileges.

Blocklisted process makes network request

Downloads MZ/PE file

Executes dropped EXE

Modifies RDP port number used by Windows

Sets DLL path for service in the registry

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.