Paper Werewolf (GOFFEE): EchoGather / XLL Loader SHA256 IOC Match
Detects file creation or process execution events where the observed SHA256 matches known EchoGather backdoor or associated XLL loader samples linked to the Paper Werewolf (GOFFEE) threat group. This is a high-confidence IOC-based detection. Use it for rapid triage and scoping; follow up with behavioral detections for durable coverage.
YARA-L
