Detect Fabookie payload

Detects Smokeloader packer

Fabookie

Fabookie is facebook account info stealer.

Modifies Windows Defender Real-time Protection settings

NullMixer

NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.

NyMaim

NyMaim is a malware with various capabilities written in C++ and first seen in 2013.

PrivateLoader

PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

Process spawned unexpected child process

This typically indicates the parent process was compromised via an exploit or macro.

RedLine

RedLine Stealer is a malware family written in C#, first appearing in early 2020.

RedLine payload

SmokeLoader

Modular backdoor trojan in use since 2014.

Suspicious use of NtCreateUserProcessOtherParentProcess

Tofsee

Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

Vidar

Vidar is an infostealer based on Arkei stealer.

xmrig

XMRig is a high performance, open source, cross platform CPU/GPU miner.

Nirsoft

Vidar Stealer

XMRig Miner payload

ASPack v2.12-2.42

Detects executables packed with ASPack v2.12-2.42

Creates new service(s)

Downloads MZ/PE file

Executes dropped EXE

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

VMProtect packed file

Detects executables packed with VMProtect commercial packer.