Zero-Dwell Threat Intelligence Reports

Berbew Trojan Loader Using WININET and Winsock for C2 Communications.exe

overlay spreader

Miniduke-Style Installer Using UPX Overlay to Deliver Credential Stealer.exe

overlay checks-user-input idle upx

UPX-Compressed Loader Executes HeavensGate Switch and Drops Payloads.exe

overlay upx

Padodor Backdoor Exhibiting Classic Berbew Traits and Registry Modifications.exe

overlay spreader

Doina-Style Loader Executing Dropped Payloads and Modifying Run Keys.exe

detect-debug-environment idle spreader

Stealer Loader Uses Long-Sleeps, Anti-Debug Checks, and Clipboard Harvesting.exe

64bits detect-debug-environment checks-cpu-name

Go-Built RAT with RequestBin DNS Callbacks and Long-Sleep Evasion.exe

64bits overlay

Malware Downloader Embeds Azorult Payload and Ransom.Stop Traces.exe

spreader

CryptoLocker Precursor Executable Embeds Overlay Resources and Spreader Traits.exe

overlay spreader

Trojanized Unity Component Disguised as Editor Plugin with C2 Indicators.dll

detect-debug-environment assembly

Win32 Upatre/Zbot Downloader Beacons and Executes Crypto-Encryptor.exe

overlay spreader

Trojanized GUI EXE Uses PowerShell Stagers to Install Stealer Modules.exe

spreader assembly