Casbaneiro post-403 MD5-named TEMP folder + HKCU\SOFTWARE key markers
Detects concurrent creation of a hexadecimal-named folder in the %TEMP% directory and a corresponding registry key in HKCU\SOFTWARE, both named with the same MD5 hash. This specific behavior is a known indicator of Casbaneiro (also known as Metamorfo) banking trojan infection, where the malware uses these locations to stage components and achieve persistence.
Microsoft Sentinel (KQL)
