DcRAT libjpeg-turbo screen capture compression before C2 upload to kkxqbh.top

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule detects potentially malicious behavior associated with the DragonReturn malware, including the loading of a specific DLL (nvdaHelperRemote.dll) by system processes or Mixed Reality tools, the execution of suspicious binary names, and network connectivity indicators related to C2 domains.