Evolving Tactics of SLOW#TEMPEST: A Deep Dive Into Advanced Malware Techniques

This report analyzes a SLOW#TEMPEST malware variant: a loader DLL distributed inside an ISO and executed via DLL side-loading. It documents sophisticated obfuscation (dynamic jumps and indirect function calls), the use of emulation and IDAPython to de-obfuscate control flow and API resolution, provides SHA256 indicators and file details, and includes mitigation and detection guidance.