Amadey

Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

Detect Xehook Payload

Detect Xworm Payload

Detects Monster Stealer.

Glupteba

Glupteba is a modular loader written in Golang with various components.

Glupteba payload

KoiLoader

KoiLoader is a malware loader written in C++.

LoaderBot

LoaderBot is a loader written in .NET downloading and executing miners.

Monster

Monster is a Golang stealer that was discovered in 2024.

Phorphiex payload

Phorphiex, Phorpiex

Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

RedLine

RedLine Stealer is a malware family written in C#, first appearing in early 2020.

RedLine payload

Xehook stealer

Xehook is an infostealer written in C#.

Xworm

Xworm is a remote access trojan written in C#.

xmrig

XMRig is a high performance, open source, cross platform CPU/GPU miner.

Detects KoiLoader payload

LoaderBot executable

Modifies boot configuration data using bcdedit

Nirsoft

XMRig Miner payload

Command and Scripting Interpreter: PowerShell

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

Creates new service(s)

Downloads MZ/PE file

Modifies Windows Firewall

Possible attempt to disable PatchGuard

Rootkits can use kernel patching to embed themselves in an operating system.

Stops running service(s)