Amadey

Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

DcRat

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

Detect Xworm Payload

Lumma Stealer

An infostealer written in C++ first seen in August 2022.

Modifies firewall policy service

PrivateLoader

PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

RedLine

RedLine Stealer is a malware family written in C#, first appearing in early 2020.

RedLine payload

SectopRAT

SectopRAT is a remote access trojan first seen in November 2019.

SectopRAT payload

UAC bypass

XMRig Miner payload

Xworm

Xworm is a remote access trojan written in C#.

xmrig

XMRig is a high performance, open source, cross platform CPU/GPU miner.

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Detects Windows executables referencing non-Windows User-Agents

Detects executables (downlaoders) containing URLs to raw contents of a paste

Detects executables built or packed with MPress PE compressor

Detects executables containing artifacts associated with disabling Widnows Defender

Detects executables embedding registry key / value combination indicative of disabling Windows Defender features

Detects executables packed with Themida

Detects executables packed with or use KoiVM

Detects executables packed with unregistered version of .NET Reactor

Detects executables using Telegram Chat Bot

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

Creates new service(s)

Downloads MZ/PE file

Stops running service(s)