Detect ZGRat V1

Detects Healer an antivirus disabler dropper

Healer

Healer an antivirus disabler dropper.

Modifies Windows Defender Real-time Protection settings

RedLine

RedLine Stealer is a malware family written in C#, first appearing in early 2020.

RedLine payload

ZGRat

ZGRat is remote access trojan written in C#.

Detects executables embedding registry key / value combination indicative of disabling Windows Defender features

Detects executables packed with ConfuserEx Mod