Amadey

Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

Aurora

Aurora is a crypto wallet stealer written in Golang.

DcRat

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

Detect Gurcu Stealer V3 payload

Detects Healer an antivirus disabler dropper

Djvu Ransomware

Ransomware which is a variant of the STOP family.

Formbook

Formbook is a data stealing malware which is capable of stealing data.

Gurcu, WhiteSnake

Gurcu is a malware stealer written in C#.

Healer

Healer an antivirus disabler dropper.

Phemedrone

An information and wallet stealer written in C#.

Process spawned unexpected child process

This typically indicates the parent process was compromised via an exploit or macro.

RedLine

RedLine Stealer is a malware family written in C#, first appearing in early 2020.

RedLine payload

Status Recorder Stealer

Status Recorder is a crypto stealer written in C++.

DCRat payload

Detects payload of DCRat, commonly dropped by NSIS installers.

Formbook payload

Downloads MZ/PE file

Stops running service(s)