Amadey

Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

AsyncRat

AsyncRAT is designed to remotely monitor and control other computers written in C#.

DcRat

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

Detect Lumma Stealer payload V2

Detect Lumma Stealer payload V4

Detect ZGRat V1

GCleaner

GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

Glupteba

Glupteba is a modular loader written in Golang with various components.

Glupteba payload

Lockbit

Ransomware family with multiple variants released since late 2019.

Lumma Stealer

An infostealer written in C++ first seen in August 2022.

MetaSploit

Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

Process spawned unexpected child process

This typically indicates the parent process was compromised via an exploit or macro.

RedLine

RedLine Stealer is a malware family written in C#, first appearing in early 2020.

RedLine payload

RisePro

RisePro stealer is an infostealer distributed by PrivateLoader.

Stealc

Stealc is an infostealer written in C++.

ZGRat

ZGRat is remote access trojan written in C#.

Async RAT payload

DCRat payload

Detects payload of DCRat, commonly dropped by NSIS installers.

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Creates new service(s)

Downloads MZ/PE file

Stops running service(s)