Cobalt Strike reflective loader

Detects the reflective loader used by Cobalt Strike.

Cobaltstrike

Detected malicious payload which is part of Cobaltstrike.

Industroyer

Also known as CrashOverride. Malware framework which targets Industrial Control Systems (ICS) related to power transmission.

Industroyer IEC-104 Module

Contains strings related to Industroyer module used to communicate with power transmission grids over IEC-104 protocol.

Merlin

Merlin is a cross-platform post-exploitation C2 framework written in golang.

Merlin payload

NetFilter

NetFilter is a rootkit first seen in June 2021.

NetFilter payload

NetWire RAT payload

Netwire

Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

Remcos

Remcos is a closed-source remote control and surveillance software.

Snake Keylogger

Keylogger and Infostealer first seen in November 2020.

Snake Keylogger payload