AgentTesla

Agent Tesla is a remote access tool (RAT) written in visual basic.

Allcome

A clipbanker that supports stealing different cryptocurrency wallets and payment forms.

Amadey

Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

DcRat

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

Deletes Windows Defender Definitions

Uses mpcmdrun utility to delete all AV definitions.

Detect Xworm Payload

Glupteba

Glupteba is a modular loader written in Golang with various components.

Glupteba payload

MetaSploit

Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

Modifies security service

ParallaxRat

ParallaxRat is a multipurpose RAT written in MASM.

ParallaxRat payload

Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.

Process spawned unexpected child process

This typically indicates the parent process was compromised via an exploit or macro.

RedLine

RedLine Stealer is a malware family written in C#, first appearing in early 2020.

RedLine payload

SmokeLoader

Modular backdoor trojan in use since 2014.

Suspicious use of NtCreateUserProcessOtherParentProcess

Vidar

Vidar is an infostealer based on Arkei stealer.

Xworm

Xworm is a remote access trojan written in C#.

DCRat payload

Detects payload of DCRat, commonly dropped by NSIS installers.

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Modifies boot configuration data using bcdedit

Downloads MZ/PE file

Drops file in Drivers directory

Modifies Windows Firewall

Possible attempt to disable PatchGuard

Rootkits can use kernel patching to embed themselves in an operating system.

Stops running service(s)