Arkei

Arkei is an infostealer written in C++.

IcedID, BokBot

IcedID is a banking trojan capable of stealing credentials.

RedLine

RedLine Stealer is a malware family written in C#, first appearing in early 2020.

RedLine Payload

SmokeLoader

Modular backdoor trojan in use since 2014.

Suspicious use of NtCreateProcessExOtherParentProcess

Tofsee

Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

Windows security bypass

suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil

suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil

xmrig

XMRig is a high performance, open source, cross platform CPU/GPU miner.

Arkei Stealer Payload

XMRig Miner Payload

Blocklisted process makes network request

Blocks application from running via registry modification

Adds application to list of disallowed applications.

Creates new service(s)

Downloads MZ/PE file

Executes dropped EXE

Modifies Windows Firewall

Sets service image path in registry