Arkei

Arkei is an infostealer written in C++.

Bazar Loader

Detected loader normally used to deploy BazarBackdoor malware.

IcedID, BokBot

IcedID is a banking trojan capable of stealing credentials.

Modifies Windows Defender Real-time Protection settings

Raccoon

Simple but powerful infostealer which was very active in 2019.

RedLine

RedLine Stealer is a malware family written in C#, first appearing in early 2020.

RedLine Payload

SmokeLoader

Modular backdoor trojan in use since 2014.

TelegramRat

Telegram_rat.

evasion

evasion.

rl_trojan

redline stealer.

suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

suricata: ET MALWARE Win32/IcedID Request Cookie

suricata: ET MALWARE Win32/IcedID Request Cookie

suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil

suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil

Arkei Stealer Payload

Bazar/Team9 Loader payload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Downloads MZ/PE file

Executes dropped EXE

Tries to connect to .bazar domain

Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.