Async RAT payload

Family: AsyncRat

AsyncRAT is designed to remotely monitor and control other computers written in C#.

Family: StormKitty

StormKitty is an open source info stealer written in C#.

StormKitty payload

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Detects Windows executables referencing non-Windows User-Agents

Detects executables attemping to enumerate video devices using WMI

Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.

Detects executables embedding registry key / value combination indicative of disabling Windows Defen

Detects executables referencing Discord tokens regular expressions

Detects executables referencing Windows vault credential objects. Observed in infostealers

Detects executables referencing credit card regular expressions

Detects executables referencing many IR and analysis tools

Detects executables referencing many VPN software clients. Observed in infosteslers

Detects executables referencing many confidential data stores found in browsers, mail clients, crypt

Detects executables referencing many email and collaboration clients. Observed in information steale

Detects executables with interest in wireless interface using netsh