Zero-Dwell Threat Intelligence Reports

Multi-Tool Go Malware: WMI Recon, Long-Sleeps, and Encrypted Beaconing.exe

64bits long-sleeps calls-wmi checks-user-input

Spreader-Enabled Lumma Binary Uses Long-Sleeps and WMI Recon.exe

long-sleeps

Trojanized AdwCleaner Binary Modifies Autorun/AppInit_DLLs for Persistence.exe

signed overlay calls-wmi assembly

Win64 Stealc v2 Implant with Long-Sleeps and Anti-Sandbox Checks.exe

long-sleeps spreader checks-cpu-name persistence

Visual Basic Dropper Deploys Remote Modules and Modifies Autorun.exe

spreader

SFX-Based Dropper Executes NSudo Launcher and Performs Registry Recon.exe

overlay detect-debug-environment

Trojanized WinRAR SFX with NSudo/NirCmd Tooling and Service-Tampering Calls.exe

overlay detect-debug-environment

Qt5Network Imposter Executes Trojan Downloader and Beaconing.dll

signed overlay detect-debug-environment invalid-signature

SFX Installer Uses PowerShell & CSC Staging to Deploy Encrypted Stealers.exe

overlay calls-wmi executes-dropped-file persistence

NSIS/Runner Fetcher Beacons to rhussois.su and prebwle.su for Tasks.exe

long-sleeps overlay calls-wmi executes-dropped-file

MSIL Androm/AgentTesla Variant Adds Startup VBS and Defender Exclusions.exe

64bits spreader assembly

RedCap/DllHijacker Implant Exported as TSVIPSrv.dll for Sideloading.dll

64bits long-sleeps detect-debug-environment