TrymeLocker Backdoor Account Creation via net.exe with rage_master_ Prefix

Ibrahim Saud@tektrix

•updated Jun 28, 2026•1•0•1

Detects the creation of local backdoor accounts with the 'rage_master_' username prefix and their subsequent addition to the local Administrators group using 'net.exe' or 'net1.exe', which is a technique characteristic of the TrymeLocker malware.