Detects Mofksys worm

Family: Mofksys

Mofksys is a worm written in VisualBasic.

Family: WarzoneRat, AveMaria

WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

Modifies WinLogon for persistence

Modifies visibility of hidden/system files in Explorer

Process spawned unexpected child process

This typically indicates the parent process was compromised via an exploit or macro.

Warzone RAT payload

Detects executables packed with ASPack

Boot or Logon Autostart Execution: Active Setup

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.