Grandoreiro Packed Delphi Payload: Known DLL Side-Load Names from AppData
Detects indicators of Grandoreiro banking trojan infection, including the loading of associated malicious DLLs from user-writable AppData directories, the execution of the specific binary 'ROt4I@m$etqv1Ns.exe' via script interpreters, and the spawning of unsigned executables from AppData by wscript.exe or cscript.exe.
SentinelOne
