.NET loader stage by imphash + section/import shape

CLR-hosted .NET infostealer: reflective assembly + browser cred theft + AES socket exfil

CLR-hosting MZER loader stage (my_sss.bin / student_s.bin), ~276KB

ClickFix v8 — MZER custom loader stub with x64 PIC bootstrapper

ClickFix v8 — Suspicious named pipes: CPFATP_ (CLR profiler abuse) / Sessions

Complete MZER GetPC stub as a code-anchor (immediate wildcarded)

Donut .NET loader by imphash — stable across all waves/branches despite per-lure SHA-256 churn

Fires on any WP-002 chain component

MZER polyglot header: position-independent Donut shellcode masquerading as PE (cross-version cluster

MZER polyglot: MZ-lookalike header that is also a GetPC self-locating x64 stub

MZER-polyglot Donut loader family: header + GetPC bootstrap prologue at offset 0

NEW in V12.1: native MinGW-w64/GCC-15 WinHTTP downloader stage fetching enterprise/student_s.bin

Native PE32+ loader: process-enum + remote-thread injection + WinHTTP stage fetch

Network IOCs for the WP-002 stage host and C2 gate

V12 C2/lure/stage-2 domains, IPs and stage path

V12.1 infra: new stage-2 IP, recycled V11 C2 domain, TDS, lure host, EtherHiding contract

WinHTTP downloader by imphash — durable cross-wave-cluster pivot

WinHTTP downloader/injector MZER stage, ~50KB

Badlisted process makes network request

Network request originating from process or tool commonly abused by malware.

Downloads MZ/PE file