Zero-Dwell Threat Intelligence Reports

Run-Key Persisting Stormous Encryptor Manipulates Internet-Zone Registry and Stops Services for Impact-Stage Encryption.exe

64bits persistence checks-network-adapters

Stormous Payload Blends Google-DNS Lookups With Startup-Folder Persistence and Recycle-Bin Concealment.exe

64bits detect-debug-environment persistence

Packed Stormous Ransomware Bundles Multi-Cipher Crypto and Tor Onion C2 With Startup-Folder Persistence.exe

64bits detect-debug-environment persistence

Stormous-Linked Python Script Uses Long-Line Obfuscation and Image File Execution Options Reconnaissance.py

idle malware

Silverfox-Related Trojan DLL Leverages CEF Library Spoofing for Phishing-Linked Persistence.dll

64bits

SilentRunLoader Variant Executes as Application form.exe With XOR-Encoded Staging Logic.exe

64bits overlay

Win32 Trojan RAR Bundle Employs Government-Assistance Theming for Payload Delivery.exe

long-sleeps detect-debug-environment

SilentRunLoader Stealer Executes via SilentRunAndUpload.exe for Covert Run-and-Exfil Workflow.exe

64bits overlay

Win32 Spreader DLL Leverages TeamSpeak Control Naming and Runtime API Linking.dll

64bits overlay spreader

Win32 Trojan Archive Masquerades as Benign German ZIP While Hunting Target Processes.exe

long-sleeps detect-debug-environment spreader

Marte-Associated Archive Leverages Script Utilities and CAPE Unhooking for Sandbox Evasion.exe

long-sleeps detect-debug-environment spreader

High-Confidence Buggie Detection: 64-bit DLL Leverages libcef Masquerading and Sandbox Evasion.dll

64bits idle spreader