AgentTesla

Agent Tesla is a remote access tool (RAT) written in visual basic.

Formbook

Formbook is a data stealing malware which is capable of stealing data.

Gh0st RAT payload

Gh0strat

Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

Modifies Windows Defender Real-time Protection settings

RedLine

RedLine Stealer is a malware family written in C#, first appearing in early 2020.

RedLine payload

SectopRAT

SectopRAT is a remote access trojan first seen in November 2019.

SectopRAT payload

SystemBC

SystemBC is a proxy and remote administration tool first seen in 2019.

Xworm

Xworm is a remote access trojan written in C#.

Deletes shadow copies

Ransomware often targets backup files to inhibit system recovery.

Formbook payload

Downloads MZ/PE file

Stops running service(s)