Modifies Windows Defender Real-time Protection settings

OnlyLogger

A tiny loader that uses IPLogger to get its payload.

Raccoon

Simple but powerful infostealer which was very active in 2019.

RedLine

RedLine Stealer is a malware family written in C#, first appearing in early 2020.

RedLine Payload

Suspicious use of NtCreateProcessExOtherParentProcess

Suspicious use of NtCreateUserProcessOtherParentProcess

Tofsee

Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

suricata: ET MALWARE EXE Download Request To Wordpress Folder Likely Malicious

suricata: ET MALWARE EXE Download Request To Wordpress Folder Likely Malicious

suricata: ET MALWARE GCleaner Downloader Activity M5

suricata: ET MALWARE GCleaner Downloader Activity M5

suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3

suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3

Identifies VirtualBox via ACPI registry values (likely anti-VM)

OnlyLogger Payload

ASPack v2.12-2.42

Detects executables packed with ASPack v2.12-2.42

Creates new service(s)

Downloads MZ/PE file

Executes dropped EXE

Modifies Windows Firewall

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.