Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

1 IOC

Call stack spoofing explained using APT41 malware

Cyber Geeks

Published October 17, 2024Original Report

Threat Actors

Excerpt

Summary Call stack spoofing isn’t a new technique , but it has become more popular in the last few years. Call stacks are a telemetry source for EDR software that can be used to determine if a process made suspicious actions (requesting a handle to the lsass process, writing suspicious code to a newly allocated area, and so on). The purpose of the technique is to construct a fake call stack that mimics a legitimate call stack in order to hide suspicious activity that…

Read the original report →

Diamond Model

Adversary(1)

Infrastructure

Capability

Victim

Attack Flow8 steps · MITRE ATT&CK mapped

ExecutionTA0002T1059

1/8

Command and Scripting Interpreter

ActionDecrypt strings at runtime

Malware decrypts relevant strings at runtime using AES with a hard-coded key.

Indicators of Compromise

Open the mindmap →

1 indicators

Type	Indicator	Confidence	Score	First Seen
SHA256	33fd050760e251ab932e5ca4311b494ef72cee157b20537ce773420845302e49	Medium	Score 53/100	First seen Jun 2, 2026

IOC Relationship Graph

Building graph…