Amadey

Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

DcRat

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

Detect Lumma Stealer payload V2

Detect Lumma Stealer payload V4

Detect Xworm Payload

Detect ZGRat V1

Detected google phishing page

Formbook

Formbook is a data stealing malware which is capable of stealing data.

Lumma Stealer

An infostealer written in C++ first seen in August 2022.

MetaSploit

Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

Modifies WinLogon for persistence

Phorphiex

Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

Process spawned unexpected child process

This typically indicates the parent process was compromised via an exploit or macro.

Quasar RAT

Quasar is an open source Remote Access Tool.

Quasar payload

RedLine

RedLine Stealer is a malware family written in C#, first appearing in early 2020.

RedLine payload

Remcos

Remcos is a closed-source remote control and surveillance software.

Rhadamanthys

Rhadamanthys is an info stealer written in C++ first seen in August 2022.

RisePro

RisePro stealer is an infostealer distributed by PrivateLoader.

SmokeLoader

Modular backdoor trojan in use since 2014.

Stealc

Stealc is an infostealer written in C++.

Suspicious use of NtCreateUserProcessOtherParentProcess

Windows security bypass

XMRig Miner payload

Xworm

Xworm is a remote access trojan written in C#.

ZGRat

ZGRat is remote access trojan written in C#.

xmrig

XMRig is a high performance, open source, cross platform CPU/GPU miner.

DCRat payload

Detects payload of DCRat, commonly dropped by NSIS installers.

Formbook payload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Blocklisted process makes network request

Creates new service(s)

Disables RegEdit via registry modification

Disables Task Manager via registry modification

Downloads MZ/PE file

Drops file in Drivers directory

Modifies Windows Firewall

Stops running service(s)