No AI analysis yet.
C2Looper is a Rust-compiled Windows backdoor family likely operated within a ransomware-affiliate ecosystem. It provides common backdoor capabilities, including running system commands and deploying arbitrary follow-on payloads — functionality likely used by an initial access broker to steal sensitive data and deploy ransomware. Despite its overall simplicity, the additional functionality in the latest variant indicates that its developers continue to expand and refine its capabilities. Its operational settings (server addresses, credentials, filenames, commands) are hidden in the binary using a simple per-build XOR scheme; recovering those keys during analysis exposed the full C2 infrastructure and produced durable detection signatures. C2Looper also injects code into a legitimate Windows print DLL (winspool.drv) and runs a domain-reconnaissance command sequence (ipconfig /all, whoami /all, nltest /dclist:, net group /domain "domain admins", wmic product get name, version) characteristic of the pre-encryption reconnaissance workflows typical of ransomware operators. Older variants also carry two repeatable coding mistakes on the attacker's side — a stray double slash in one of the URLs and a status counter that always reports zero — that survive recompiles and give defenders high-confidence detection anchors. Older variants of C2Looper use plaintext HTTP for command and control: the malware collects basic host information (hostname, username, process ID), sends it to the attacker's server as a small JSON message, and then runs whichever command comes back in the reply. Newer variants add several commands and, most notably, switch their command channel to GitHub — all check-ins, exfiltrated data, and command output flow through the GitHub Contents API rather than through the attacker's own server. On top of the move to GitHub, the newer variant introduces new commands and changes how several existing commands behave.