CrySome credential-theft DLL dropped and injected after browser process kill

Ethan Andrews@eandrews

•updated Jul 9, 2026•6•0•8

Detects the execution chain associated with the CrySome RAT, which terminates common web browsers (Chrome, Edge, Brave), drops a malicious DLL ('abe_decrypt.dll') into a temporary directory, and subsequently restarts the browser to facilitate credential theft.