# Major Malware Family Characteristics

Reference guide for identifying common malware families by their behavioral
and structural characteristics.

## Banking Trojans

### Qakbot (QBot, Quakbot)

- **Type**: Banking trojan, loader
- **Active**: 2008-present (disrupted 2023, resurfaced)
- **Delivery**: Phishing emails with malicious attachments (ZIP/OneNote/PDF)
- **Key indicators**:
  - DLL-based payload, loaded via regsvr32 or rundll32
  - Process injection into wermgr.exe or explorer.exe
  - Scheduled task persistence with randomized names
  - Encrypted configuration in PE resources
  - Web injects for banking credential theft
- **C2**: HTTPS with rotating infrastructure, encrypted config blob
- **Import patterns**: Heavy use of networking and process injection APIs
- **Typical imports**: `HttpOpenRequestA`, `InternetConnectA`, `CreateRemoteThread`

### Emotet

- **Type**: Loader, banking trojan (evolved to primarily a delivery platform)
- **Active**: 2014-present (disrupted 2021, resurfaced 2022)
- **Delivery**: Phishing with macro-enabled Office documents, reply-chain hijacking
- **Key indicators**:
  - Heavily obfuscated macros or scripts as initial stage
  - Self-extracting to %LOCALAPPDATA% or %TEMP%
  - Windows service persistence
  - Encrypted C2 communication with custom binary protocol
  - Modular architecture with downloadable plugins
- **C2**: HTTP/HTTPS POST with binary data, multiple C2 servers in config
- **Distinguishing traits**: Frequent repacking, polymorphic binaries

### TrickBot

- **Type**: Banking trojan, modular framework
- **Active**: 2016-present (heavily disrupted)
- **Key indicators**:
  - Modular architecture with plugin DLLs
  - Modules: pwgrab, injectDll, networkDll, rdpScanDll
  - Group tag in configuration (gtag)
  - ECC-encrypted C2 communication
  - Creates a unique bot ID based on system info

## Information Stealers

### RedLine Stealer

- **Type**: Information stealer (MaaS)
- **Active**: 2020-present
- **Key indicators**:
  - .NET compiled binary
  - Targets browser credentials, crypto wallets, FTP clients, VPN configs
  - Collects system information (hardware, installed software)
  - C2 over TCP with custom protocol
  - Often packed with ConfuserEx or custom .NET packers
- **Typical strings**: "RedLine", "Yandex", "Chromium", "Gecko"

### Raccoon Stealer

- **Type**: Information stealer (MaaS)
- **Active**: 2019-present (v2 since 2022)
- **Key indicators**:
  - C/C++ compiled
  - Downloads legitimate DLLs for data parsing (sqlite3.dll, nss3.dll)
  - Configuration received from C2 after initial check-in
  - Targets browsers, email clients, crypto wallets
  - Machine ID-based fingerprinting

### Vidar

- **Type**: Information stealer
- **Active**: 2018-present
- **Key indicators**:
  - Fork of Arkei stealer
  - Downloads working DLLs from C2 (freebl3.dll, mozglue.dll, etc.)
  - Configuration ID in C2 URL path
  - Profile-based exfiltration (configurable targets)
  - Creates ZIP archive of stolen data before exfiltration

## Remote Access Trojans (RATs)

### Cobalt Strike (Beacon)

- **Type**: Commercial adversary simulation tool, widely abused
- **Key indicators**:
  - Malleable C2 profiles (highly configurable network signatures)
  - Named pipes for SMB lateral movement (default: `\.\pipe\msagent_*`)
  - Reflective DLL injection
  - Sleep with jitter between callbacks
  - Watermark value in beacon configuration
- **Configuration extraction**: Parse beacon config from shellcode or DLL
- **Default ports**: 80, 443, 8080 (configurable)

### AsyncRAT

- **Type**: Open-source RAT
- **Active**: 2019-present
- **Key indicators**:
  - .NET compiled
  - AES-256 encrypted C2 communication
  - Mutex pattern: `AsyncMutex_*`
  - Persistence via scheduled tasks or registry Run key
  - Certificate pinning for C2 validation
- **Configuration**: Embedded in .NET resources, AES encrypted with hardcoded key

### Remcos

- **Type**: Commercial RAT (marketed as legitimate, widely abused)
- **Key indicators**:
  - C/C++ compiled
  - RCDATA resource containing encrypted configuration
  - RC4 encryption for C2 communication
  - Keylogger stored in `%APPDATA%\remcos\logs.dat`
  - Registry persistence under HKCU\Software\Remcos-*

## Loaders and Droppers

### BatLoader

- **Type**: Loader distributed via SEO poisoning
- **Key indicators**:
  - Batch script initial stage
  - PowerShell download cradles
  - Drops legitimate installers alongside malware
  - MSI-based delivery mechanism

### IcedID (BokBot)

- **Type**: Banking trojan turned loader
- **Key indicators**:
  - DLL with specific export function names
  - Fake GIF file (PNG header inside) as stage 2 download
  - License.dat configuration file
  - HTTPS C2 with cookie-based data exchange
  - Forked loader variant with stripped banking module

### Bumblebee

- **Type**: Loader (associated with Conti/TrickBot operators)
- **Key indicators**:
  - ISO/VHD delivery containers
  - DLL loaded via COM hijacking or rundll32
  - Group ID in configuration
  - Custom C2 protocol over HTTPS
  - Anti-VM and anti-sandbox checks

## Ransomware Families


## Worms

### Raspberry Robin

- **Type**: Worm / loader
- **Key indicators**:
  - USB-based propagation via LNK files
  - Uses msiexec.exe to download payloads
  - QNAP NAS devices as C2 infrastructure
  - Heavily obfuscated multi-layer payload
  - Tor-based C2 fallback

## APT Tooling

### PlugX (Korplug)

- **Type**: RAT used by multiple Chinese APT groups
- **Key indicators**:
  - DLL sideloading via legitimate signed executables
  - Three-component loading: legit EXE + malicious DLL + encrypted payload
  - Custom binary C2 protocol
  - Persistence via services or Run keys

### Havoc (Demon)

- **Type**: Open-source C2 framework
- **Key indicators**:
  - Shellcode-based agent
  - Sleep obfuscation (Ekko, Zilean)
  - Indirect syscalls
  - Token vault for credential management
  - Supports multiple C2 protocols (HTTP/S, SMB)

## Identification Tips

When trying to identify a malware family:

1. **Check imphash** against known databases (VirusTotal, MalwareBazaar)
2. **Search unique strings** (mutexes, PDB paths, custom user-agents)
3. **Examine C2 protocol** patterns (URL paths, HTTP headers, port choices)
4. **Compare PE structure** (section names, resource types, compilation tools)
5. **Look for configuration structures** (embedded configs, encrypted blobs)
6. **Check behavioral signatures** with YARA and capa rules
7. **Use code similarity tools** to compare against reference samples