CrimsonRAT main payload

CrimsonRat

Crimson RAT is a malware linked to a Pakistani-linked threat actor.

Dharma

Dharma is a ransomware that uses security software installation to hide malicious activities.

ModiLoader, DBatLoader

ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

Modifies WinLogon for persistence

RevengeRAT

Remote-access trojan with a wide range of capabilities.

UAC bypass

WarzoneRat, AveMaria

WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

njRAT/Bladabindi

Widely used RAT written in .NET.

Deletes shadow copies

Ransomware often targets backup files to inhibit system recovery.

ModiLoader First Stage

ReZer0 packer

Detects ReZer0, a packer with multiple versions used in various campaigns.

Renames multiple (561) files with added filename extension

This suggests ransomware activity of encrypting all the files on the system.

RevengeRat Executable

Warzone RAT payload

Adds policy Run key to start application

Manipulates Digital Signatures

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

Modifies Windows Firewall

Sets file to hidden

Modifies file attributes to stop it showing in Explorer etc.