Amadey

Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

Detect ZGRat V1

GCleaner

GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

Glupteba

Glupteba is a modular loader written in Golang with various components.

Glupteba payload

RedLine

RedLine Stealer is a malware family written in C#, first appearing in early 2020.

RedLine payload

Suspicious use of NtCreateProcessExOtherParentProcess

Suspicious use of NtCreateUserProcessOtherParentProcess

Windows security bypass

ZGRat

ZGRat is remote access trojan written in C#.

xmrig

XMRig is a high performance, open source, cross platform CPU/GPU miner.

Creates a large amount of network flows

This may indicate a network scan to discover remotely running services.

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Modifies boot configuration data using bcdedit

XMRig Miner payload

Command and Scripting Interpreter: PowerShell

Using powershell.exe command.

Contacts a large (764) amount of remote hosts

This may indicate a network scan to discover remotely running services.

Creates new service(s)

Downloads MZ/PE file

Drops file in Drivers directory

Modifies Installed Components in the registry

Modifies Windows Firewall

Possible attempt to disable PatchGuard

Rootkits can use kernel patching to embed themselves in an operating system.

Stops running service(s)