Amadey

Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

Arkei

Arkei is an infostealer written in C++.

LoaderBot

LoaderBot is a loader written in .NET downloading and executing miners.

SmokeLoader

Modular backdoor trojan in use since 2014.

Tofsee

Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

Vidar

Vidar is an infostealer based on Arkei stealer.

Windows security bypass

xmrig

XMRig is a high performance, open source, cross platform CPU/GPU miner.

Arkei Stealer Payload

LoaderBot executable

Vidar Stealer

XMRig Miner Payload

Blocklisted process makes network request

Creates new service(s)

Downloads MZ/PE file

Executes dropped EXE

Modifies Windows Firewall

Sets service image path in registry

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.