Dolphin X loader drops and executes new payload after Agent C2 connection (port 32768)

Duo Tech@duotech

•updated Jul 27, 2026•2•0•4

Detects the creation and immediate execution of an unsigned binary on a system within two minutes of that system establishing an outbound network connection to port 32768, which is the command and control (C2) port associated with the Dolphin X stealer. This rule aims to identify the behavior of a secondary payload being fetched and launched by the initial loader.