Execution of PhantomPull Loader (syncobs.exe)
Detects the execution of the primary PhantomPull loader component ('syncobs.exe') before it decrypts and reflectively loads the final PhantomPulse RAT payload, as observed in the REF6598 campaign.
Sigma
Detects the execution of the primary PhantomPull loader component ('syncobs.exe') before it decrypts and reflectively loads the final PhantomPulse RAT payload, as observed in the REF6598 campaign.
Already have an account?