Modifies Windows Defender Real-time Protection settings

OnlyLogger

A tiny loader that uses IPLogger to get its payload.

RedLine

RedLine Stealer is a malware family written in C#, first appearing in early 2020.

RedLine Payload

Vidar

Vidar is an infostealer based on Arkei stealer.

suricata: ET MALWARE EXE Download Request To Wordpress Folder Likely Malicious

suricata: ET MALWARE EXE Download Request To Wordpress Folder Likely Malicious

suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern

suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern

suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3

suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3

suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2

suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2

OnlyLogger Payload

Vidar Stealer

Downloads MZ/PE file

Executes dropped EXE

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

VMProtect packed file

Detects executables packed with VMProtect commercial packer.