Jonas Wagner

Earlier this week, our friends at @nextronresearch documented an RRCfg delivery chain. We hunted for implants with similar code in our platform and uncovered additional samples and delivery chains dating back to September 2026, using different hosts, sideloaded DLLs and C2 infrastructure. 🔹 21 September 2026 — arphaCrashReport.exe / arphaDump64.dll. Alibaba’s arphaCrashReport.exe, renamed 20260921163500-CC1DB4D9D1744A.exe, sideloads malicious arphaDump64.dll. Its bootstrap downloads Donut from hxxps://xiaxiazai.hkg.bcebos[.]com/kekehua/27.124.41.111.bin on Baidu Cloud BOS and executes it, loading RRCfg configured for 27.124.41[.]111:8083. Report: reports.threatray.com/331547… 🔹23 September 2026 — ClosePre.exe / kcommon64.dll. ClosePre.exe, renamed 2026095SDDE20.exe, sideloads malicious kcommon64.dll. Its bootstrap requests hxxps://gdnkdl[.]eu[.]cc/files/ahfayui.eu.cc.bin. No next-stage payload was received. 🔹22 October 2026 — BioEnrollmentHost.exe / wincorlib.dll. Microsoft BioEnrollmentHost.exe, renamed 20261022128205.BC6FBTAC08T.exe, sideloads malicious wincorlib.dll. The DLL decrypts a bootstrap embedded in the host’s certificate table. It downloads Donut from hxxps://aawwf.hkg.bcebos[.]com/shiade/A03.bin, also on Baidu Cloud BOS, which loads RRCfg configured for 192.252.178[.]174:8083. The loader shares Nextron’s CAFEBABECAFEBABE marker, RC4 key AtkExEmbedKey2026, and SCURLTPL URL configuration. Report: reports.threatray.com/83d1ff… 🔹25 October 2026 — ahfayui.eu.cc C2 variant. An RRCfg implant uses ahfayui[.]eu[.]cc, which resolved to 61.18.208[.]171. The same hostname appears in the payload filenames requested by the ClosePre and Edge loaders. Report: reports.threatray.com/4cd9fe… 🔹3 November 2026 — Edge notification_helper.exe / dbghelp.dll. Microsoft Edge notification_helper.exe, renamed INV-No.20261102023748.exe, sideloads malicious dbghelp.dll. This loader also decrypts a certificate-embedded bootstrap, then requests hxxps://bmafhahl[.]eu[.]cc/files/ahfayui.eu.cc.bin. No next-stage payload was received. 🧬 Sample hashes, #IOCs and analysis reports: github.com/threatray/threat-…

🎯 It’s #ThreatrayTuesday — a weekly drop of new malware families we spot in the wild. This week, 6 new families spotted, including a stealer that after exfiltrating login credentials changes Steam and Discord passwords. #RaptorStealer. Steals logins, then changes Steam and Discord passwords. Sample analysis report: reports.threatray.com/c46d92… #HydrRAT #OpportunistStealer #RxClientStealer #KushnerStealer #OpsexStealer 🧬 Full #IOCs and analysis reports: github.com/threatray/threat-…

🚨 Following Cisco @TalosSecurity NIK C2 report (blog.talosintelligence.com/n…), we found additional samples and indicators. We previously featured this Go-based Windows RAT as #NIKRAT in September’s #ThreatrayTuesday tweet: reports.threatray.com/9336fa… Our analysis identified two additional C2 addresses: - 2.26.49[.]181 - 191.44.109[.]125 Both addresses are associated with the same self-signed TLS certificate, with serial number: 7a47dbb89a7dbe9f33d9d6d5d3c04ca9bae6fbff We also found additional host indicators: - Commands to create a NIKGuardian scheduled task that launches NetworkGuard.vbs every minute - A registry Run value named NIKClient - Mutex names matching Local\NIK_<16hex>_agent and Local\NIK_<16hex>_wd 🧬 Sample hashes, #IOCs and analysis reports: github.com/threatray/threat-…

🎯 It’s #ThreatrayTuesday — a weekly drop of new malware families we spot in the wild. This week, 7 new families spotted, including a RAT which redirects crypto payments to attackers. #DarkCoreRAT. Invisible hidden-desktop takeover that quietly hijacks crypto payments on the side. Sample analysis report: reports.threatray.com/b5123d… #VanishRAT #YarrakcanStealer #BunnyStealer #KaziStealer #MahiRAT #LarpestanRAT 🧬 Full #IOCs and analysis reports: github.com/threatray/threat-…

🎯 It’s #ThreatrayTuesday — a weekly drop of new malware families we spot in the wild. This week, 8 new families spotted, including a banker that swaps IBANs and rewrites transfer amounts in banking sessions. #ATSBanker. Banker swapping IBANs and rewriting transfer amounts. Sample analysis report: reports.threatray.com/5defd6… #LithiumCrypter #CherryStealer #CinderRAT #RuntimeBreaker #ChickenStealer #ConquerRAT #PhanterStealer 🧬 Full #IOCs and analysis reports: github.com/threatray/threat-…

🎯 It’s #ThreatrayTuesday — a weekly drop of new malware families we spot in the wild. This week, 6 new families spotted, including a HTTP-polling C++ RAT with Chromium ABE stealer and WMI persistence. #IronRAT. RAT with Chromium ABE stealer and WMI persistence. Sample analysis report: reports.threatray.com/d34f0e… #DPPBotRAT #TakerStealer #NoobSaibotRAT #YamiStealer #AudaxStealer 🧬 Full #IOCs and analysis reports: github.com/threatray/threat-…

🎯 It’s #ThreatrayTuesday — a weekly drop of new malware families we spot in the wild. This week, 7 new families spotted, including a multi-tenant .NET banker targeting Portuguese Santander customers. #KrasnyBanker. Banker targeting Portuguese Santander customers. Sample analysis report: reports.threatray.com/88694d… #CookieGrab_ABE #GiaPhucStealer #AntigravityAdvancedStealer #VantaRAT #CollextorRAT #JJMStealer 🧬 Full #IOCs and analysis reports: github.com/threatray/threat-…

🎯 It’s #ThreatrayTuesday — a weekly drop of new malware families we spot in the wild. This week, 6 new families spotted, including 3 of these families using Discord: 2 stealers send stolen data to Discord webhooks and a RAT controlled through a Discord bot. #VexioStealer. Discord-webhook stealer grabbing browsers, Wi-Fi, screenshots. Sample analysis report: reports.threatray.com/27bef9… #SentyStealer. Rust Discord stealer. Sample analysis report: reports.threatray.com/ae1cde… #MonitorRAT. Discord-bot RAT with Cloudflare Workers config. Sample analysis report: reports.threatray.com/53e5b7… #BSTStealer #NIKRAT #MegaRAT 🧬 Full #IOCs and analysis reports: github.com/threatray/threat-…

🎯 It’s #ThreatrayTuesday — a weekly drop of new malware families we spot in the wild. This week, 7 new families spotted, including a a Valorant cheat loader that conceals a stealer. #Iceg3nStealer. Valorant cheat loader hiding a stealer. Sample analysis report: #LLHNStealer #FractureRAT #ExistRAT #ApocOmega #XLogStealer #Fl1xxStealer 🧬 Full #IOCs and analysis reports: github.com/threatray/threat-…

🪶 We recovered five #SparroWocky payloads, four of them previously unreported — including a variant not covered in @ESETresearch’s writeup: it drops the Mbed TLS stack entirely and communicates with its C&C using DNS over port 53. SparroWocky is #FamousSparrow's new flagship backdoor, replacing SparrowDoor: welivesecurity.com/en/eset-r… The backdoor itself never touches disk. Instead, it is reflectively loaded from an encrypted .dat container with the MZ and PE magic values stripped. So we hunted the container rather than the implant. ESET documented its layout: a 4-byte magic (0x11328712), config size, payload size, followed by a 16-byte RC4 key. Decrypting the payload with the key at offset 12 and restoring the stripped PE magic values recovers the backdoor. Of the five payloads we recovered, one was documented by ESET. The other four were previously unreported and revealed three new C&C IPs — plus the first domain-based C&C seen for this family. e0b6f8535e19f0a4938e3317de0c4493ecea17aa906fd0454805ba2086cbf3a8 (reported by ESET) d08e09a17df22fb39838dcc9e99756830ef5175bc9e03d615adf979dc85ed052 4e8a3ca7be64c7d546598483bcf0f16023c1cac5506f400ba736c6b42daf1d73 (DNS variant) ef9e3e831b736b79561abeb4acf5acbb154b406ea245498a03f55715fc6bc73b bb284f7977fc0251274f6188d6dd64d1bc95004a00b9ba7c8420a2c0f461ebf1 38.54.45[.]155 38.54.89[.]158 77.111.101[.]153 .files.seosnskorea[.]com 🔎 The most interesting find is the DNS variant. 4e8a3ca7 retains the core SparroWocky implementation — same container format, reflective PE loader, and inline-hook engine — but changes its configuration and C&C communication. Instead of the tab-separated config, it uses a length-prefixed TLV structure. It targets a domain rather than a bare IP and replaces Mbed TLS with a DNS client subsystem communicating over port 53. Sample report: reports.threatray.com/abf0f8… We also recovered four previously unreported loaders. All four are patched copies of the same legitimate WinFsp DLL, in two build groups — one pair keeps the original six sections, the other adds an .idata section rebuilt over the Authenticode signature. Each patches a different region of .text and redirects the PE entry point into it. 🧬 Find the #IOCs here: github.com/threatray/threat-…

🎯 It’s #ThreatrayTuesday — a weekly drop of new malware families we spot in the wild. This week, 8 new families spotted, including a Rust implant with hVNC and lateral movement. #DolphinX. Rust implant with hVNC and lateral movement. Sample analysis report: reports.threatray.com/f77e09… #EqSteal #RaffleStealer #LuzixStark #ProjectStealer #OnyxC2 #AestheticStealer #WorstStealer 🧬 Full #IOCs and analysis reports: github.com/threatray/threat-…

🎯 It’s #ThreatrayTuesday — a weekly drop of new malware families we spot in the wild. This week, 7 new families spotted, including a stealer that exfiltrates via a Cloudflare Worker. #FlowzifritStealer. Cloudflare worker. Sample analysis report: reports.threatray.com/d12803… #KhaiDiGrabber #ChromeExtractor #ProjectZStealer #SaturnStealer #RedDelphin #LiveMicRAT 🧬 Full #IOCs and analysis reports: github.com/threatray/threat-…

🎯 It’s #ThreatrayTuesday — a weekly drop of new malware families we spot in the wild. This week, 6 new families spotted, including a stealer that sends the stolen data as issue bodies to GitHub. #AkhassatStealer. Stolen data is POSTed as GitHub issue bodies. Sample analysis report: reports.threatray.com/5c7779… #CapyAgent #ZyxStealer #FearStealer #CarsoRansomware #OpnKeyRansomware 🧬 Full #IOCs and analysis reports: github.com/threatray/threat-…

🎯 It’s #ThreatrayTuesday — a weekly drop of new malware families we spot in the wild. This week, 7 new families spotted, including a RAT that is controlled with a Discord bot. #JumpscareRAT. Discord-bot-controlled RAT. Sample analysis report: reports.threatray.com/7ebc2c… #CtfCookieExtractor #LpxiterDownloader #ArvionRAT #SnakeBiteRAT #XenRAT #NimdesStealer 🧬 Full #IOCs and analysis reports: github.com/threatray/threat-…

🎯 It’s #ThreatrayTuesday — a weekly drop of new malware families we spot in the wild. This week, 8 new families spotted, including a stealer that exfiltrates to a Discord webhook and later wipes user data. #PrefireWiper. Exfiltrates user data to a Discord webhook and then wipes all the information. Sample analysis report: reports.threatray.com/b81544… #EdgeRAT #AokigaharaStealer #YoucefGrabber #RobHook #DeekStealer #SbcfgRAT #f4maxStealer 🧬 Full #IOCs and analysis reports: github.com/threatray/threat-…

🎯 It’s #ThreatrayTuesday — a weekly drop of new malware families we spot in the wild. This week, 6 new families spotted, including a ransomware that offers the decryption routine through Telegram. #SuperboyKing. Decryption routine obtained through Telegram. Sample analysis report: reports.threatray.com/bbef20… #PostureStealer #HeroinRAT #WaterStealer #ShiverStealer #KlisatuLoader 🧬 Full #IOCs and analysis reports: github.com/threatray/threat-…

🎯 It’s #ThreatrayTuesday — a weekly drop of new malware families we spot in the wild. This week, 5 new families spotted, including various stealers using Telegram for exfiltration. #RavenStealer. Stealer exfiltrating through Telegram. Sample analysis report: reports.threatray.com/461ff1… #Zlogger #GoTelegramStealer #AsterStealer #BlackStealer 🧬 Full #IOCs and analysis reports: github.com/threatray/threat-…

🎯 It’s #ThreatrayTuesday — a weekly drop of new malware families we spot in the wild. This week, 8 new families spotted, including a stealer that exfiltrates via the Discord Bot API. #FudRAT — Exfiltrates via the Discord Bot API. Sample analysis report: reports.threatray.com/3300c8… #ElitraFly #GolstaStealer #DojinerBackdoor #MelloDiscordTokenStealer #OsuStealer #HealrktRAT #NeedleStealer 🧬 Full #IOCs and analysis reports: github.com/threatray/threat-…

🎯 It’s #ThreatrayTuesday — a weekly drop of new malware families we spot in the wild. This week, 6 new families spotted, including a wiper masquerading as a 'Fortnite Account Puller’ exfiltrating via Discord. #FAPWiper — A wiper masquerading as a ‘Fortnite Account Puller’, exfiltrating via Discord. Sample analysis report: reports.threatray.com/1f4d0d… #GalaxyRAT #StanleyRAT #PrettyDerbyStealer #GrimSpectorStealer #BaneStealer 🧬 Full #IOCs and analysis reports: github.com/threatray/threat-…