STAC4749 PowerShell Download and Execution of Loader/Backdoor Chain

Duo Tech@duotech

•updated Jul 31, 2026•0•0•4

Detects PowerShell-driven download and execution of STAC4749 loader/backdoor payloads (ms_876*.exe, sekv*.exe, helper*.exe, 74fs*/7414fs*.exe, 45234ssdf403851640.exe, updater.exe, msupdate.exe) staged in AppData\Roaming or AppData\Local\Temp, or execution from known STAC4749 download domains/URLs.