Zero-Dwell Threat Intelligence Reports

CobaltStrike Artifact Used for Persistent Remote Access and Dumping.exe

64bits spreader

Stealer with Long-Sleeps and WMI Calls Targets Wallets & Logins.exe

64bits detect-debug-environment calls-wmi spreader

Floxif/Pioneer Virus Masquerading as Microsoft Edge Update.exe

overlay

LokiBot Infostealer Hidden in ASPack-Packed Signature Cloner.exe

long-sleeps detect-debug-environment spreader malware

Lazy/Lumma Stealer Uses TLS SNI to Contact prebwle.su and Consnbx.su.exe

spreader

Krypt/Formbook Variant Uses PowerShell Exclusions to Evade.exe

spreader assembly

Kryptik/Formbook Variant Using PowerShell Whitelisting for Evasion.exe

spreader assembly

ConfuserEx-Packed ClipBanker Injects into Browsers to Sniff Clipboard.exe

assembly

Remote Access Trojan Hides in Themida-Wrapped Reporter Binary.exe

themida

Trojanized Qlcapgtwpsw.exe Adds Defender Exclusions and Harvests Logins.exe

spreader assembly

Trojanized Screenshot Tool Captures Desktop and Steals Data.bin

64bits long-sleeps detect-debug-environment

Lumma Stealer Bundled as “Tiger Youtube Bot” Installer.exe

spreader malware