MovieReaper Campaign Known-Hash Activity

Arnold Chan@slaz

•updated 22 days ago•1•0•4

Detects process and file creation activity matching known MovieReaper loader and downstream module file hashes (MD5/SHA256). C2 IP/domain network indicators for this campaign require a separate network_connection-category rule, since Sigma logsource categories cannot be mixed within a single rule.