Amadey

Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

DcRat

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

Detect Lumma Stealer payload V4

Detect Xworm Payload

Detect ZGRat V1

Detected Djvu ransomware

Djvu Ransomware

Ransomware which is a variant of the STOP family.

Gh0st RAT payload

Gh0strat

Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

Guloader,Cloudeye

A shellcode based downloader first seen in 2020.

Lumma Stealer

An infostealer written in C++ first seen in August 2022.

MetaSploit

Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

Process spawned unexpected child process

This typically indicates the parent process was compromised via an exploit or macro.

RedLine

RedLine Stealer is a malware family written in C#, first appearing in early 2020.

RedLine payload

SectopRAT

SectopRAT is a remote access trojan first seen in November 2019.

SectopRAT payload

SmokeLoader

Modular backdoor trojan in use since 2014.

UAC bypass

Windows security bypass

XMRig Miner payload

Xworm

Xworm is a remote access trojan written in C#.

YTStealer

YTStealer is a malware designed to steal YouTube authentication cookies.

YTStealer payload

ZGRat

ZGRat is remote access trojan written in C#.

xmrig

XMRig is a high performance, open source, cross platform CPU/GPU miner.

DCRat payload

Detects payload of DCRat, commonly dropped by NSIS installers.

Modifies boot configuration data using bcdedit

Downloads MZ/PE file

Modifies Windows Firewall

Possible attempt to disable PatchGuard

Rootkits can use kernel patching to embed themselves in an operating system.

Sets file execution options in registry