Amadey

Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

DcRat

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

Modifies WinLogon for persistence

Modifies Windows Defender Real-time Protection settings

Process spawned unexpected child process

This typically indicates the parent process was compromised via an exploit or macro.

RedLine

RedLine Stealer is a malware family written in C#, first appearing in early 2020.

RedLine payload

DCRat payload

Detects payload of DCRat, commonly dropped by NSIS installers.

Disables Task Manager via registry modification

Downloads MZ/PE file

Executes dropped EXE