Danabot

Danabot is a modular banking Trojan that has been linked with other malware.

Danabot x86 payload

Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

Modifies WinLogon for persistence

Process spawned unexpected child process

This typically indicates the parent process was compromised via an exploit or macro.

RevengeRAT

Remote-access trojan with a wide range of capabilities.

ReZer0 packer

Detects ReZer0, a packer with multiple versions used in various campaigns.

RevengeRat Executable

Blocklisted process makes network request

Downloads MZ/PE file

Office macro that triggers on suspicious action

Office document macro which triggers in special circumstances - often malicious.

Sets file to hidden

Modifies file attributes to stop it showing in Explorer etc.