Detected Djvu ransomware

Djvu Ransomware

Ransomware which is a variant of the STOP family.

FFDroider

Stealer targeting social media platform users first seen in April 2022.

FFDroider Payload

Modifies Windows Defender Real-time Protection settings

OnlyLogger

A tiny loader that uses IPLogger to get its payload.

Process spawned unexpected child process

This typically indicates the parent process was compromised via an exploit or macro.

RecordBreaker

RecordBreaker is an information stealer capable of downloading and executing secondary payloads written in C++.

Socelars

Socelars is an infostealer targeting browser cookies and credit card credentials.

Socelars Payload

Tofsee

Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

Vidar

Vidar is an infostealer based on Arkei stealer.

suricata: ET MALWARE Generic Stealer Config Download Request

suricata: ET MALWARE Generic Stealer Config Download Request

suricata: ET MALWARE Recordbreaker Stealer CnC Checkin

suricata: ET MALWARE Recordbreaker Stealer CnC Checkin

suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

suricata: ET MALWARE Win32/FFDroider CnC Activity M2

suricata: ET MALWARE Win32/FFDroider CnC Activity M2

suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3

suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3

suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2

suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2

NirSoft WebBrowserPassView

Password recovery tool for various web browsers

Nirsoft

OnlyLogger Payload

Vidar Stealer

Creates new service(s)

Downloads MZ/PE file

Executes dropped EXE

Modifies Windows Firewall

VMProtect packed file

Detects executables packed with VMProtect commercial packer.