HEAVYGRAM Loader Shellcode Staging via deadhub[.]org C2

Ibrahim Saud@tektrix

•updated 21 days ago•0•0•3

Detects network activity associated with shellcode staging, specifically requests to the domain 'deadhub.org' or its specific IP address using hardcoded paths that mimic static UI assets. This activity is indicative of a loader fetching malicious fragments for in-memory execution.