AutoIT loader reads extensionless sibling payload nloemfbihmhm for in-memory XOR

Ankit Mehta@Secvyn

•updated 25 days ago•0•0•3

Detects the creation or modification of a file with a specific randomized name ('nloemfbihmhm') in the temporary directory, followed by the execution of a process identified as AutoIt from the same directory.