ZscalerPublished
Technical Analysis of 2CLoader
Excerpt
String encryption
Important strings in 2CLoader are decrypted at runtime using an inlined bitwise XOR operation applied to global values. The key in the analyzed sample is 0x37 .
Indirect system calls
For the Nt* APIs listed below, 2CLoader prefers indirect system calls to evade inline API hooks commonly used by security software for detection.
NtProtectVirtualMemory
NtUnmapViewOfSection
NtQueryInformationProcess
NtDelayExecution
NtSe…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Zscaler on zscaler.com.
More from Zscaler6
- msupdater-trojan-and-link-targeted-attacksZscaler · Added 19 Oct
- APT37 Ruby Jumper: Air-Gap Attack via Removable MediaZscaler · Published 26 Feb
- Vidar Virtual Machine-Based String ObfuscationZscaler · Published 21 Sep
- C2Looper Backdoor Uses GitHub for C2Zscaler · Published 17 Aug
On the same topics
- Lorem Ipsum Revisited: ClickFix Pivot & Rapid BrigantineBlueVoyant · Added 25 Oct
- From PostCSS Masquerading to Windows RATJFrog · Published 22 Jun
- Showboat Malware: Emerging Threats Targeting Telecom ProvidersLumen Black Lotus Labs · Added 25 Oct
- International law enforcement initiate hunt on malware group SocGholishDutch National Police · Published 18 Jun
