IcedID, BokBot

IcedID is a banking trojan capable of stealing credentials.

Raccoon

Simple but powerful infostealer which was very active in 2019.

SmokeLoader

Modular backdoor trojan in use since 2014.

Suspicious use of NtCreateProcessExOtherParentProcess

suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01

suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01

suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload

suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload

suricata: ET MALWARE Win32.Raccoon Stealer - Telegram Mirror Checkin (generic)

suricata: ET MALWARE Win32.Raccoon Stealer - Telegram Mirror Checkin (generic)

suricata: ET MALWARE Win32/IcedID Request Cookie

suricata: ET MALWARE Win32/IcedID Request Cookie

IcedID First Stage Loader

Blocklisted process makes network request

Downloads MZ/PE file

Executes dropped EXE