Detect Fabookie payload

Detects LgoogLoader payload

Detects PseudoManuscrypt payload

Fabookie

Fabookie is facebook account info stealer.

GCleaner

GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

LgoogLoader

A downloader capable of dropping and executing other malware families.

OnlyLogger

A tiny loader that uses IPLogger to get its payload.

Process spawned unexpected child process

This typically indicates the parent process was compromised via an exploit or macro.

PseudoManuscrypt

PseudoManuscrypt is a malware Lazarus’s Manuscrypt targeting government organizations and ICS.

RedLine

RedLine Stealer is a malware family written in C#, first appearing in early 2020.

RedLine payload

SectopRAT

SectopRAT is a remote access trojan first seen in November 2019.

SectopRAT payload

Suspicious use of NtCreateUserProcessOtherParentProcess

Vidar

Vidar is an infostealer based on Arkei stealer.

xmrig

XMRig is a high performance, open source, cross platform CPU/GPU miner.

OnlyLogger payload

Vidar Stealer

XMRig Miner payload

Blocklisted process makes network request