Amadey

Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

DcRat

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

Detected google phishing page

Glupteba

Glupteba is a modular loader written in Golang with various components.

Modifies Windows Defender Real-time Protection settings

Phobos

Phobos ransomware appeared at the beginning of 2019.

RedLine

RedLine Stealer is a malware family written in C#, first appearing in early 2020.

RedLine payload

SmokeLoader

Modular backdoor trojan in use since 2014.

Suspicious use of NtCreateUserProcessOtherParentProcess

Tofsee

Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

WarzoneRat, AveMaria

WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

Windows security bypass

Deletes shadow copies

Ransomware often targets backup files to inhibit system recovery.

Modifies boot configuration data using bcdedit

Renames multiple (214) files with added filename extension

This suggests ransomware activity of encrypting all the files on the system.

Warzone RAT payload

Blocklisted process makes network request

Creates new service(s)

Deletes backup catalog

Uses wbadmin.exe to inhibit system recovery.

Downloads MZ/PE file

Drops file in Drivers directory

Modifies Windows Firewall

Sets service image path in registry

Stops running service(s)