ACRStealer hollowed wab.exe secondary C2 domain lookup (bsc.rpc.blxrbdn.com)

Duo Tech@duotech

•updated Aug 17, 2026•0•0•0

Detects DNS/TLS SNI lookups for the hollowed wab.exe process's secondary C2 domains (bsc.rpc.blxrbdn.com, lb.propertyfind.cc) and the correlated follow-on connection to their resolved IPs, flagging the shared Cloudflare IP 172.67.161.234 for additional host-side process-lineage verification.