@endrift@social.treehouse.systems
Post #1705130
2026-04-16 07:32 UTC
So to summarize: Disguised Python loader loads a base85 Python script, which itself loads a base64 zlib-compressed Python script, which injects some machine code into another process, which likely contains further obfuscations.
Replies (1)
-
@endrift@social.treehouse.systems 2026-04-16 07:41
Ok, it looks like it starts the CLR...in the Python process I think? Some code is run next that I don't know exactly what that does, but it seems to monkeypatch the clr DLL in the current process, which I think specifically is to bypass the Anti-Malware Scan Interface by replacing a reference to amsi.dll with ansi.dll. And then it invokes the payload in the process itself using LdrCallEnclave, I think.