SPARKRAT
Named by 2 kept items in this workspace.
Search every workspace for SPARKRAT. It matches the name as written, so it can find other things that share it.
The items that name it 2
Secondary payload dropped by threat actors post-exploitation of CVE-2026-1731.
Malware identified via VirusTotal as the identity of dllhost.exe/agent.exe in Incident 2.
All threat actors in this workspace.