AgentTesla

Agent Tesla is a remote access tool (RAT) written in visual basic.

AsyncRat

AsyncRAT is designed to remotely monitor and control other computers written in C#.

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Detect Xworm Payload

Process spawned unexpected child process

This typically indicates the parent process was compromised via an exploit or macro.

Quasar RAT

Quasar is an open source Remote Access Tool.

Quasar payload

RedLine

RedLine Stealer is a malware family written in C#, first appearing in early 2020.

RedLine payload

Rhadamanthys

Rhadamanthys is an info stealer written in C++ first seen in August 2022.

SectopRAT

SectopRAT is a remote access trojan first seen in November 2019.

SectopRAT payload

Suspicious use of NtCreateUserProcessOtherParentProcess

Xworm

Xworm is a remote access trojan written in C#.

Command and Scripting Interpreter: PowerShell

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

Creates new service(s)

Downloads MZ/PE file

Drops file in Drivers directory

Possible privilege escalation attempt

Stops running service(s)