Zero-Dwell Threat Intelligence Reports

Trojanized .NET Keylogger with Startup Persistence and Remote Exfiltration.exe

long-sleeps spreader assembly persistence

Trojanized Invoicer Binary Drops Remcos with Rmc-5SDT03 Mutex.exe

long-sleeps detect-debug-environment persistence

Stealer with Autorun Persistence and Encrypted SSL Command Channel.exe

64bits long-sleeps calls-wmi spreader persistence

RAR SFX Loader Executes Batch Chains to Kill Defender and Deploy Payload.exe

overlay detect-debug-environment calls-wmi

Rundll32-Executed DLL Drops Loader and Creates Run Keys for Persistence.dll

64bits long-sleeps detect-debug-environment

Backdoor Loader with Long-Sleeps, WMI Calls, and Encrypted Beaconing.exe

detect-debug-environment assembly persistence

Utility Imposter Using AspNetCompiler-Like Techniques for Payload Delivery.exe

direct-cpu-clock-access runtime-modules

Dropper Beacons to armydevice.shop / glossmagazine.shop and Deploys Stealers.exe

detect-debug-environment

Spyware Drops via PowerShell Defender Exclusions and Shellcode Loader.exe

shellcode

ROZETATECH-Signed Binary Masks as JEDITOR.exe to Deploy Downloader.exe

signed overlay checks-user-input

Install.exe Drops Lumma/Rhadamanthys and Harvests Browser Logins.exe

signed 64bits overlay calls-wmi spreader

CobaltStrike Artifact Used for Persistent Remote Access and Dumping.exe

64bits spreader