TONResolver: PowerShell BigInteger Dropper Chain → Node.js RAT in AppData

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects a suspicious PowerShell command sequence involving network downloads to temporary directories followed by the execution of a Node.js binary from within the user's AppData directory within a 30-minute window. This behavior is indicative of a dropper pattern where a malicious script retrieves and executes a secondary stage payload.