Malware
TEARDROP
TEARDROP is a memory only dropper that runs as a service, spawns a thread and reads from the file “gracious_truth.jpg”, which likely has a fake JPG header.
TEARDROP is a Windows malware family operated by UNC2452.
Background
TEARDROP is a memory-only dropper that operates as a service, launches a thread, and reads from “gracious_truth.jpg”, a file that probably carries a bogus JPG header. It then verifies the presence of HKU\SOFTWARE\Microsoft\CTF, uses a custom rolling XOR routine to decode an embedded payload, and loads that payload directly into memory via a bespoke PE-like format. The code shares no overlap with previously documented malware, and FireEye assessed it was used to launch a customized Cobalt Strike BEACON.
Source: Malpedia (Fraunhofer FKIE).