RedLine

RedLine Stealer is a malware family written in C#, first appearing in early 2020.

RedLine Payload

Tofsee

Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

xmrig

XMRig is a high performance, open source, cross platform CPU/GPU miner.

XMRig Miner Payload

Creates new service(s)

Downloads MZ/PE file

Executes dropped EXE

Modifies Windows Firewall

Sets service image path in registry

VMProtect packed file

Detects executables packed with VMProtect commercial packer.