NEBULA npm cluster and KNTRAT payload shared file hash sweep

Suraj A@cytech

•updated 4 days ago•0•0•1

Detects the presence of known SHA-256 hashes associated with the NEBULA preinstall.cjs dropper and KNTRAT PE across file creation, process execution, and image load events over a 30-day window.