General
- Target https://zuehlkelife.com/v7sd8fzf5qs/index.php
- Sample261009-whpwlasz3n
Score
9/10
Malware Config
Targets
-
- Target https://zuehlkelife.com/v7sd8fzf5qs/index.php
Score9/10-
ClickFix v8 — Suspicious named pipes: CPFATP_ (CLR profiler abuse) / Sessions
-
Durable RSA-1024 CAPI C2 handshake public key (modulus). Cross-wave anchor.
-
Durable WP-002 RSA-1024 CAPI PUBLICKEYBLOB (e=65537). Runtime-resolved in PowerShell stage; modulus
-
Embedded CAPI PUBLICKEYBLOB carrying the DURABLE RSA-1024 C2 handshake key (e=65537). Client RSA-wra
-
Embedded RSA-1024 C2 handshake public key (CAPI RSA1 blob, e=65537). Client RSA-wraps the AES sessio
-
Fires on any WP-002 chain component (prologue OR durable imphash OR embedded C2 key).
-
WP002_durable_RSA1024_C2_handshake_key