CrimsonRAT main payload

CrimsonRat

Crimson RAT is a malware linked to a Pakistani-linked threat actor.

MetaSploit

Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

ModiLoader, DBatLoader

ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

Netwire

Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

Process spawned unexpected child process

This typically indicates the parent process was compromised via an exploit or macro.

njRAT/Bladabindi

Widely used RAT written in .NET.

ModiLoader First Stage

Blocklisted process makes network request

Downloads MZ/PE file

Modifies Windows Firewall