CrySome RAT Client Execution with C2 Connection Indicating Active hVNC-Enabled Session
Detects execution of processes associated with the CrySome Remote Access Trojan (RAT), identified by known binary names ('patch_diag.exe', 'patch.exe') or file hash. Additionally, it monitors for outbound network connections to a specific, hardcoded C2 IP address (193.26.115.42) on port 5555, which is associated with CrySome RAT's hVNC-enabled client.
Cortex XDR
