โ ๏ธ ๐ก๐ฒ๐ ๐ฆ๐๐ฎ๐ด๐ฒ๐ฟ ๐๐ฒ๐ฎ๐ฑ๐ถ๐ป๐ด ๐๐ผ ๐ฅ๐๐ง ๐๐ฒ๐ฝ๐น๐ผ๐๐บ๐ฒ๐ป๐: ๐๐ฒ๐๐ฒ๐ฐ๐ ๐๐ ๐๐ฎ๐ฟ๐น๐
We caught RUTSSTAGER, a malware that stores a DLL in the Windows registry in hexadecimal form, hiding the payload and delaying detection. In the observed chain, the stager delivered OrcusRAT, followed by a supporting binary that maintains persistence, uses PowerShell for system checks, and restarts the RAT process.
In the ANYRUN Sandbox, behavioral analysis and file system monitoring exposed the full execution chain. Process synchronization events revealed coordination between the stager and its payload, helping confirm multi-stage malware activity early.
See the analysis session and collect IOCs to speed up detection and response: https://app.any.run/tasks/b357aa61-29d5-4c7f-87f8-359281319a72
Pivot from indicators and subscribe to Query Updates to proactively track evolving attacks: https://intelligence.any.run/analysis/lookup
Posted Mar 5, 2026, 7:53 PM UTC