C2Looper
A Windows backdoor variant that used GitHub-backed tasking for post-C2 command delivery.
Variant-specific coverage
Explore Proofmetry malware coverage.
Coverage is version- and variant-specific. Browse current records for C2Looper, Abyssos v2.1F, and ACRstealer. Additional family work remains private.
Coverage records
Public family records
Open a coverage record for its scope, or read the related research brief.
Abyssos v2.1F
A modular RAT variant with host, process, file, collection, lifecycle, and desktop behavior.
ACRstealer
Coverage development is in progress for one analyzed v4.3.7-alpha2 infostealer profile.
Additional private coverage
Other malware families are covered privately and are not publicly disclosed.
Proofmetry can work with your team to assess a requested family or variant and develop coverage for the behaviors you need to validate.
Evidence vocabulary
Proofmetry Evidence Status
Evidence progresses only as far as the observations support. A mapped behavior does not automatically become a confirmed endpoint effect.
- 01
Mapped
A behavior or handler was identified through analysis.
- 02
Path reached
Execution entered the intended code path.
- 03
Result observed
A meaningful intermediate or returned result was observed.
- 04
Terminal state observed
The workflow reached a defined completion or stop condition.
- 05
Endpoint effect confirmed
The intended native endpoint or network effect was corroborated.
Guided evaluation
See whether current coverage fits your detection or data objective.
We confirm family, variant, behavior-test, and evidence fit before a customer-controlled run.
Get a demo