Amadey

Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

AsyncRat

AsyncRAT is designed to remotely monitor and control other computers written in C#.

DcRat

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

Detect Vidar Stealer

Detect Xworm Payload

Detect ZGRat V1

ParallaxRat

ParallaxRat is a multipurpose RAT written in MASM.

ParallaxRat payload

Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.

Process spawned unexpected child process

This typically indicates the parent process was compromised via an exploit or macro.

PureLog Stealer

PureLog Stealer is an infostealer written in C#.

PureLog Stealer payload

Quasar RAT

Quasar is an open source Remote Access Tool.

Quasar payload

Raccoon

Raccoon is an infostealer written in C++ and first seen in 2019.

Raccoon Stealer V2 payload

RedLine

RedLine Stealer is a malware family written in C#, first appearing in early 2020.

RedLine payload

RisePro

RisePro stealer is an infostealer distributed by PrivateLoader.

SectopRAT

SectopRAT is a remote access trojan first seen in November 2019.

SectopRAT payload

Stealc

Stealc is an infostealer written in C++.

Vidar

Vidar is an infostealer based on Arkei stealer.

Xworm

Xworm is a remote access trojan written in C#.

ZGRat

ZGRat is remote access trojan written in C#.

xmrig

XMRig is a high performance, open source, cross platform CPU/GPU miner.

Async RAT payload

DCRat payload

Detects payload of DCRat, commonly dropped by NSIS installers.

Identifies VirtualBox via ACPI registry values (likely anti-VM)

NirSoft WebBrowserPassView

Password recovery tool for various web browsers

Nirsoft

XMRig Miner payload

Creates new service(s)

Dave packer

Detects executable using a packer named 'Dave' by the community, based on a string at the end.

Downloads MZ/PE file

Sets file execution options in registry

Stops running service(s)