Malicious service media_updaten created for persistence

Ethan Andrews@eandrews

•updated Aug 17, 2026•1•0•2

Detects the creation and configuration of a Windows service named 'media_updaten' via command-line utilities (sc.exe) or direct registry modification. This service is associated with CoolClient for persistence to relaunch 'Sang.exe' with a 'work' parameter.