Arkei

Arkei is an infostealer written in C++.

IcedID, BokBot

IcedID is a banking trojan capable of stealing credentials.

RedLine

RedLine Stealer is a malware family written in C#, first appearing in early 2020.

RedLine Payload

SmokeLoader

Modular backdoor trojan in use since 2014.

Tofsee

Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

Windows security bypass

xmrig

XMRig is a high performance, open source, cross platform CPU/GPU miner.

Arkei Stealer Payload

IcedID First Stage Loader

XMRig Miner Payload

Blocklisted process makes network request

Blocks application from running via registry modification

Adds application to list of disallowed applications.

Creates new service(s)

Downloads MZ/PE file

Executes dropped EXE

Modifies Windows Firewall

Sets service image path in registry