Zero-Dwell Threat Intelligence Reports

Lumma/Stealc Dropper Executes via regsvr32 and MSBuild.exe

spreader

Packed MSIL Trojan Phones Home to Telegram and SMTP.exe

spreader assembly

Rhadamanthys Stealer Delivered by Fake Installer.exe

detect-debug-environment checks-user-input spreader

OOBE Imposter Snatches Clipboard Keys.exe

64bits spreader

Sliver RAT Surfaces as Routine Logging Utility.exe

64bits long-sleeps calls-wmi spreader persistence

Sliver Backdoor Impersonates Syslog Utility.exe

checks-user-input idle

Windows OOBE Trojan Steals Clipboard Funds.exe

64bits spreader

ClipBanker Stealer Masquerades as UserOOBEBroker.exe.exe

assembly

MetaStealer Disguised as Microsoft Edge PWA Launcher.exe

long-sleeps detect-debug-environment calls-wmi

NSIS Dropper Installs Lumma Stealer via PowerShell.exe

overlay corrupt executes-dropped-file

FormBook Variant Disguised as Event Log Analyzer.exe

spreader assembly

Gopuram Backdoor as Microsoft sspicli.dll.dll

64bits detect-debug-environment