Amadey

Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

AsyncRat

AsyncRAT is designed to remotely monitor and control other computers written in C#.

BlackNET

BlackNET is an open source remote access tool written in VB.NET.

BlackNET payload

Detect Lumma Stealer payload V4

Detect Xworm Payload

Detect ZGRat V1

Glupteba

Glupteba is a modular loader written in Golang with various components.

Glupteba payload

Lumma Stealer

An infostealer written in C++ first seen in August 2022.

MetaSploit

Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

RedLine

RedLine Stealer is a malware family written in C#, first appearing in early 2020.

RedLine payload

Remcos

Remcos is a closed-source remote control and surveillance software.

SectopRAT

SectopRAT is a remote access trojan first seen in November 2019.

SectopRAT payload

SmokeLoader

Modular backdoor trojan in use since 2014.

Windows security bypass

XMRig Miner payload

Xworm

Xworm is a remote access trojan written in C#.

ZGRat

ZGRat is remote access trojan written in C#.

xmrig

XMRig is a high performance, open source, cross platform CPU/GPU miner.

Async RAT payload

Modifies boot configuration data using bcdedit

Creates new service(s)

Downloads MZ/PE file

Drops file in Drivers directory

Modifies Windows Firewall

Possible attempt to disable PatchGuard

Rootkits can use kernel patching to embed themselves in an operating system.

Stops running service(s)