Fake Telegram Download Site Delivers Stealthy In-Memory Malware Loader

A typosquatting-based malware campaign distributes a trojanized Telegram installer (tsetup-x64.6.exe) that drops a malicious DLL (AutoRecoverDat.dll) and a legitimate Telegram installer as a decoy. The malware adds Windows Defender exclusions, creates registry markers, reconstructs and executes a PE payload in memory via reflective loading under rundll32.exe, and maintains persistent C2 connectivity (27.50.59.77:18852 / jiijua.com) with an update mechanism; IOCs including MD5 hashes are provided.