AdWind

A Java-based RAT family operated as malware-as-a-service.

Detect XtremeRAT Payload

Lokibot

Lokibot is a Password and CryptoCoin Wallet Stealer.

Modifies firewall policy service

Sality

Sality is backdoor written in C++, first discovered in 2003.

UAC bypass

Windows security bypass

XtremeRAT

The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

suricata: ET MALWARE LokiBot Checkin

suricata: ET MALWARE LokiBot Checkin

suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1

suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1

suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

Disables RegEdit via registry modification

Disables Task Manager via registry modification

Executes dropped EXE

Modifies Installed Components in the registry

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.