C2looper Static Signature

Duo Tech@duotech

•updated Aug 18, 2026•3•0•5

Detects C2Looper Rust-based backdoor by requiring at least 3 of 4 weak indicator categories: dynamic API resolution artifacts, v2 debug string, PE section layout, and Rust runtime strings; known hash is an optional fast-path only