AsyncRat

AsyncRAT is designed to remotely monitor and control other computers.

Process spawned unexpected child process

This typically indicates the parent process was compromised via an exploit or macro.

WarzoneRat, AveMaria

WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

suricata: ET MALWARE Possible Windows executable sent when remote host claims to send a Text File

suricata: ET MALWARE Possible Windows executable sent when remote host claims to send a Text File

Async RAT payload

Warzone RAT Payload

Downloads MZ/PE file

Executes dropped EXE