Arkei

Arkei is an infostealer written in C++.

IcedID, BokBot

IcedID is a banking trojan capable of stealing credentials.

RedLine

RedLine Stealer is a malware family written in C#, first appearing in early 2020.

RedLine Payload

SmokeLoader

Modular backdoor trojan in use since 2014.

Tofsee

Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

WarzoneRat, AveMaria

WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

Windows security bypass

suricata: ET MALWARE Win32/IcedID Request Cookie

suricata: ET MALWARE Win32/IcedID Request Cookie

suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil

suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil

xmrig

XMRig is a high performance, open source, cross platform CPU/GPU miner.

Arkei Stealer Payload

Warzone RAT Payload

XMRig Miner Payload

Blocklisted process makes network request

Blocks application from running via registry modification

Adds application to list of disallowed applications.

Creates new service(s)

Downloads MZ/PE file

Executes dropped EXE

Modifies Windows Firewall

Sets service image path in registry