.NET loader stage by imphash + section/import shape

CLR-hosted .NET infostealer assembly: GDI screen capture + AES CryptoStream + raw TcpClient exfil +

CLR-hosted .NET infostealer: reflective assembly + browser cred theft + AES socket exfil

CLR-hosting MZER loader (student_s.bin, /std/ branch); boots .NET/Donut infostealer via mscoree.

CLR-hosting MZER loader stage (my_sss.bin / student_s.bin), ~276KB

ClickFix v8 — MZER custom loader stub with x64 PIC bootstrapper

ClickFix v8 — Suspicious named pipes: CPFATP_ (CLR profiler abuse) / Sessions

Complete MZER GetPC stub as a code-anchor (immediate wildcarded)

Donut .NET loader by imphash — stable across all waves/branches despite per-lure SHA-256 churn

Durable RSA-1024 CAPI C2 handshake public key (modulus). Cross-wave anchor.

Durable cross-wave MZER+GetPC polyglot prologue at offset 0 (loader stage)

Durable native downloader / CLR loader imphash anchors (PE stages of the family)

Embedded CAPI PUBLICKEYBLOB carrying the DURABLE RSA-1024 C2 handshake key (e=65537). Client RSA-wra

Embedded RSA-1024 C2 handshake public key (CAPI RSA1 blob, e=65537). Client RSA-wraps the AES sessio

Fires on any WP-002 chain component

Fires on any WP-002 chain component (prologue OR durable imphash OR embedded C2 key).

Injected CLR-hosted .NET infostealer (memory scan): AES-over-raw-TCP + screen capture + WMI recon

MZER CLR-hosting loader; boots .NET/Donut infostealer via mscoree. Durable imphash.

MZER polyglot header + complete GetPC self-locating x64 stub (branch immediate wildcarded)

MZER polyglot header: MZ-lookalike that is also a GetPC self-locating x64 stub at offset 0. Loader-s

MZER polyglot header: position-independent Donut shellcode masquerading as PE (cross-version cluster

MZER polyglot: MZ-lookalike header that is also a GetPC self-locating x64 stub

MZER polyglot: MZ-lookalike header that is also a GetPC self-locating x64 stub (offset 0). Durable c

MZER polyglot: MZ-lookalike header that is also a GetPC self-locating x64 stub. Durable cross-wave c

MZER-polyglot Donut loader family: header + GetPC bootstrap prologue at offset 0

Memory-scan capability fingerprint for the WP-002 CLR-hosted infostealer, confirmed by direct memory

NEW in V12.1: native MinGW-w64/GCC-15 WinHTTP downloader stage fetching enterprise/student_s.bin

Native PE32+ loader: process-enum + remote-thread injection + WinHTTP stage fetch

Native x64 MZER WinHTTP downloader/injector (~50KB). Served as /enterprise/my_sss.bin.

Network IOCs for the WP-002 stage host and C2 gate

V12.1 infra: new stage-2 IP, recycled V11 C2 domain, TDS, lure host, EtherHiding contract

WP002_MZER_CLR_hosting_loader_imphash

WP002_MZER_CLR_loader_shape

WP002_MZER_GetPC_polyglot_prologue

WP002_MZER_WinHTTP_downloader_imphash

WP002_MZER_WinHTTP_injector_shape

WP002_MZER_overlay_reflective_loader

WP002_MZER_polyglot_dispatch_stub

WP002_downloader_embedded_config

WP002_downloader_mingw_build_markers

WP002_downloader_sid_matched_injection

WP002_durable_RSA1024_C2_handshake_key

WP002_embedded_dotnet_in_polyglot

WP002_infostealer_capability_fp

WP002_v1414_stage_uri_enterprise_bin

WinHTTP downloader by imphash — durable cross-wave-cluster pivot

WinHTTP downloader/injector MZER stage (std_enterprise ~50KB).

WinHTTP downloader/injector MZER stage, ~50KB

Badlisted process makes network request

Network request originating from process or tool commonly abused by malware.

Boot or Logon Autostart Execution: Active Setup

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

Downloads MZ/PE file