ZscalerPublished
C2Looper Backdoor Uses GitHub for C2
Excerpt
C2Looper Backdoor Uses GitHub for C2 | ThreatLabz
By ThreatLabz
Technical Analysis
In the following sections, ThreatLabz examines the technical details of the identified C2Looper variants, including their features, network communication protocols and commands.
String encryption and Windows API resolution
All identified C2Looper variants use string encryption and dynamically resolve Windows C2Looper uses the Windows API functions LoadLibrary
necessary functions at runtime.
C2Looper decrypts strings at runtime using a bitwise XOR operation with an 8-byte key having a single decryption function for every encrypted string,…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Zscaler on zscaler.com.
Mentioned in the excerpt
More from Zscaler6
- msupdater-trojan-and-link-targeted-attacksZscaler · Added 19 Oct
- APT37 Ruby Jumper: Air-Gap Attack via Removable MediaZscaler · Published 26 Feb
- Technical Analysis of 2CLoaderZscaler · Published 30 Sep
- Vidar Virtual Machine-Based String ObfuscationZscaler · Published 21 Sep
On the same topics
- Lorem Ipsum Revisited: ClickFix Pivot & Rapid BrigantineBlueVoyant · Added 25 Oct
- From PostCSS Masquerading to Windows RATJFrog · Published 22 Jun
- Showboat Malware: Emerging Threats Targeting Telecom ProvidersLumen Black Lotus Labs · Added 25 Oct
- International law enforcement initiate hunt on malware group SocGholishDutch National Police · Published 18 Jun
