CrimsonRAT Backdoor Execution via ProgramData/AppData Hard Link

Ibrahim Saud@tektrix

•updated Sep 20, 2026•0•0•1

Detects the execution of processes named 'doxc' or 'hzwzucr_widsisa.exe', or processes matching specific file hashes, when originating from common user-writeable directories like 'ProgramData' or 'AppData'. This behavior is frequently associated with malicious payloads executing in non-standard or user-specific locations to achieve persistence or evasion.