Detect Neshta payload

Modifies system executable filetype association

Neshta

Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

njRAT/Bladabindi

Widely used RAT written in .NET.

suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback (Capture)

suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback (Capture)

suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback (Process Listing)

suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback (Process Listing)

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.

Disables Task Manager via registry modification

Executes dropped EXE

Modifies Windows Firewall

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.