Amadey

Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

DcRat

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

Detect Fabookie payload

Detects Smokeloader packer

Fabookie

Fabookie is facebook account info stealer.

GCleaner

GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

Modifies Windows Defender Real-time Protection settings

NullMixer

NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.

PrivateLoader

PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

Raccoon

Raccoon is an infostealer written in C++ and first seen in 2019.

RedLine

RedLine Stealer is a malware family written in C#, first appearing in early 2020.

RedLine payload

SmokeLoader

Modular backdoor trojan in use since 2014.

Suspicious use of NtCreateUserProcessOtherParentProcess

Vidar

Vidar is an infostealer based on Arkei stealer.

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Nirsoft

Vidar Stealer

ASPack v2.12-2.42

Detects executables packed with ASPack v2.12-2.42

Downloads MZ/PE file

Executes dropped EXE

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

VMProtect packed file

Detects executables packed with VMProtect commercial packer.