Amadey

Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

DcRat

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

Detect ZGRat V1

Glupteba

Glupteba is a modular loader written in Golang with various components.

Glupteba payload

Modifies Windows Defender Real-time Protection settings

Raccoon

Raccoon is an infostealer written in C++ and first seen in 2019.

Raccoon Stealer payload

RedLine

RedLine Stealer is a malware family written in C#, first appearing in early 2020.

RedLine payload

SectopRAT

SectopRAT is a remote access trojan first seen in November 2019.

SectopRAT payload

SmokeLoader

Modular backdoor trojan in use since 2014.

Suspicious use of NtCreateUserProcessOtherParentProcess

ZGRat

ZGRat is remote access trojan written in C#.

Modifies boot configuration data using bcdedit

Blocklisted process makes network request

Downloads MZ/PE file

Modifies Windows Firewall

Possible attempt to disable PatchGuard

Rootkits can use kernel patching to embed themselves in an operating system.

Stops running service(s)