mrmustard Stealer C2 Endpoint Deobfuscation via Base64+XOR (tf_compat_v2 key)
Detects the mrmustard stealer's base64+XOR C2 endpoint deobfuscation routine, keyed on the 'tf_compat_v2' string combined with its decode-call markers.
Sigma
Detects the mrmustard stealer's base64+XOR C2 endpoint deobfuscation routine, keyed on the 'tf_compat_v2' string combined with its decode-call markers.
Already have an account?