Colibri Loader

A loader sold as MaaS first seen in August 2021.

DcRat

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

Raccoon

Raccoon is an infostealer written in C++ and first seen in 2019.

RedLine

RedLine Stealer is a malware family written in C#, first appearing in early 2020.

RedLine Payload

Vidar

Vidar is an infostealer based on Arkei stealer.

suricata: ET MALWARE Generic Stealer Config Download Request

suricata: ET MALWARE Generic Stealer Config Download Request

suricata: ET MALWARE Generic gate .php GET with minimal headers

suricata: ET MALWARE Generic gate .php GET with minimal headers

suricata: ET MALWARE Trojan Generic - POST To gate.php with no accept headers

suricata: ET MALWARE Trojan Generic - POST To gate.php with no accept headers

suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer

suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer

suricata: ET MALWARE W32/Agent.OGR!tr.pws Stealer

suricata: ET MALWARE W32/Agent.OGR!tr.pws Stealer

suricata: ET MALWARE Win32/Colibri Loader Activity

suricata: ET MALWARE Win32/Colibri Loader Activity

suricata: ET MALWARE Win32/Colibri Loader Activity M2

suricata: ET MALWARE Win32/Colibri Loader Activity M2

suricata: ET MALWARE Win32/Colibri Loader Activity M3

suricata: ET MALWARE Win32/Colibri Loader Activity M3

suricata: ET MALWARE Win32/RecordBreaker CnC Checkin

suricata: ET MALWARE Win32/RecordBreaker CnC Checkin

Vidar Stealer

Downloads MZ/PE file

Executes dropped EXE

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.