FFDroider

Stealer targeting social media platform users first seen in April 2022.

FFDroider Payload

Glupteba

Glupteba is a modular loader written in Golang with various components.

Glupteba Payload

MetaSploit

Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

Modifies Windows Defender Real-time Protection settings

OnlyLogger

A tiny loader that uses IPLogger to get its payload.

Process spawned unexpected child process

This typically indicates the parent process was compromised via an exploit or macro.

RedLine

RedLine Stealer is a malware family written in C#, first appearing in early 2020.

RedLine Payload

SmokeLoader

Modular backdoor trojan in use since 2014.

Socelars

Socelars is an infostealer targeting browser cookies and credit card credentials.

Socelars Payload

Suspicious use of NtCreateUserProcessOtherParentProcess

Tofsee

Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

Windows security bypass

suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

suricata: ET MALWARE Win32/FFDroider CnC Activity M2

suricata: ET MALWARE Win32/FFDroider CnC Activity M2

suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3

suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3

suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2

suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2

OnlyLogger Payload

Downloads MZ/PE file

Executes dropped EXE

Modifies Windows Firewall

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.