Blackmoon, KrBanker

Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

Detect Blackmoon payload

Detect PurpleFox Rootkit

Detect PurpleFox Rootkit.

Gh0st RAT payload

Gh0strat

Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

PurpleFox

PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

Drops file in Drivers directory

Server Software Component: Terminal Services DLL

Sets service image path in registry