Amadey

Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

AsyncRat

AsyncRAT is designed to remotely monitor and control other computers written in C#.

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

DcRat

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

Detect Lumma Stealer payload V2

Detect Lumma Stealer payload V4

Detect Vidar Stealer

Detect Xworm Payload

Detects HijackLoader (aka IDAT Loader)

Gozi

Gozi is a well-known and widely distributed banking trojan.

HijackLoader

HijackLoader is a multistage loader first seen in 2023.

Lumma Stealer

An infostealer written in C++ first seen in August 2022.

Modifies firewall policy service

Modifies security service

PrivateLoader

PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

Process spawned unexpected child process

This typically indicates the parent process was compromised via an exploit or macro.

PureLog Stealer

PureLog Stealer is an infostealer written in C#.

PureLog Stealer payload

Quasar RAT

Quasar is an open source Remote Access Tool.

Quasar payload

RedLine

RedLine Stealer is a malware family written in C#, first appearing in early 2020.

RedLine payload

Rhadamanthys

Rhadamanthys is an info stealer written in C++ first seen in August 2022.

SectopRAT

SectopRAT is a remote access trojan first seen in November 2019.

SectopRAT payload

Stealc

Stealc is an infostealer written in C++.

Suspicious use of NtCreateUserProcessOtherParentProcess

Tofsee

Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

UAC bypass

Vidar

Vidar is an infostealer based on Arkei stealer.

WarzoneRat, AveMaria

WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

Windows security bypass

Xworm

Xworm is a remote access trojan written in C#.

DCRat payload

Detects payload of DCRat, commonly dropped by NSIS installers.

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Modifies boot configuration data using bcdedit

Warzone RAT payload

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Run Powershell and hide display window.

Contacts a large (627) amount of remote hosts

This may indicate a network scan to discover remotely running services.

Creates new service(s)

Downloads MZ/PE file

Drops file in Drivers directory

Modifies Windows Firewall

Possible attempt to disable PatchGuard

Rootkits can use kernel patching to embed themselves in an operating system.

Possible privilege escalation attempt

Sets file to hidden

Modifies file attributes to stop it showing in Explorer etc.

Stops running service(s)