C2Looper Backdoor Shell Output Capture via c2_out.txt

Duo Tech@duotech

•updated Aug 18, 2026•2•0•8

Detects C2Looper's remote interactive shell and ShellExecuteW run-and-self-delete command execution, correlated with the c2_out.txt output-capture artifact.