DcRat

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

Detects Eternity stealer

Eternity

Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.

Process spawned unexpected child process

This typically indicates the parent process was compromised via an exploit or macro.

RedLine

RedLine Stealer is a malware family written in C#, first appearing in early 2020.

RedLine payload

Vidar

Vidar is an infostealer based on Arkei stealer.

suricata: ET MALWARE DCRAT Activity (GET)

suricata: ET MALWARE DCRAT Activity (GET)

suricata: ET MALWARE Observed Zingo/GinzoStealer CnC Domain (nominally .ru in TLS SNI)

suricata: ET MALWARE Observed Zingo/GinzoStealer CnC Domain (nominally .ru in TLS SNI)

suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

DCRat payload

Detects payload of DCRat, commonly dropped by NSIS installers.

Vidar Stealer

Downloads MZ/PE file

Executes dropped EXE

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.