C2Looper is a new Rust-based malware family likely tied to ransomware, first identified in. It has been delivered to victims through a multi-stage ClickFix infection chain with low to medium confidence. C2Looper supports backdoor commands including executing arbitrary commands, performing reconnaissance, and deploying second-stage payloads. In the technical analysis, C2Looper uses string encryption and dynamically resolves Windows APIs. The malware decrypts strings at runtime using a bitwise XOR operation with an 8-byte key.
Network communication is conducted through plaintext HTTP to communicate with its C2 server. The JSON object contains host information, username, DNS hostname of the compromised host, process identifier (PID), and bot ID. This information is sent to the endpoint every second to request a command. C2Looper appears to be under active development, with the latest variant using GitHub for all C2 operations, including storing exfiltrated data and reporting command output.[/subscribe_to_unlock_form]
C2Looper is a new Rust-based malware family likely tied to ransomware, first identified in. It has been delivered to victims through a multi-stage ClickFix infection chain with low to medium confidence. C2Looper supports backdoor commands including executing arbitrary commands, performing reconnaissance, and deploying second-stage payloads. In the technical analysis, C2Looper uses string encryption and dynamically resolves Windows APIs. The malware decrypts strings at runtime using a bitwise XOR operation with an 8-byte key.
Network communication is conducted through plaintext HTTP to communicate with its C2 server. The JSON object contains host information, username, DNS hostname of the compromised host, process identifier (PID), and bot ID. This information is sent to the endpoint every second to request a command. C2Looper appears to be under active development, with the latest variant using GitHub for all C2 operations, including storing exfiltrated data and reporting command output.[emaillocker id="1283"]
The malware has introduced new commands and modified existing ones. It captures command output using Windows pipes and stores it in a malicious file files. Zscaler's multilayered cloud security platform detects indicators related to C2Looper at various levels.
| Tactic | Technique Id | Technique | Sub-technique |
|---|---|---|---|
| Initial access | T1566.002 | Phishing | Spearphishing Link |
| Execution | T1059.006 | Command and Scripting Interpreter | Python |
| Persistence | T1547.001 | Boot or Logon Autostart Execution | Registry Run Keys / Startup Folder |
| Defence Evasion | T1027 | Obfuscated Files or Information | - |
| Collection | T1005 | Data from Local System | - |
| Command and control | T1071.001 | Application Layer Protocol | Web Protocols |
| Exfiltration | T1041 | Exfiltration Over C2 Channel | - |
| Objective | Behavior ID | Behavior |
|---|---|---|
| Command & Control | B0030 | C2 Communication |
| Impact | B0022 | Remote Access |
| Anti-Static Analysis | B0032 | Executable Code Obfuscation |
| Anti-Behavioral Analysis | B0003 | Dynamic Analysis Evasion |
| Discovery | E1082 | System Information Discovery |
| Command & Control | E1105 | Ingress Tool Transfer |
The following reports contain further technical details:
[/emaillocker]