BabylonRAT Firefox-masquerading dropper (unsigned/mismatched PE)

Ibrahim Saud@tektrix

•updated 22 days ago•0•0•2

Detects suspicious PE files that masquerade as Mozilla Firefox by using Firefox-related product names and metadata, but lack valid Mozilla Corporation code-signing signatures and are located within the ProgramData directory.