Multi-stage loader chains Kramer-obfuscated Python, Donut shellcode and laZzzy to deliver an embedded .NET DLL
TrustedSec analyzed a multi-stage malware loader that starts as obfuscated Python bytecode (.pyc, CPython 3.13) and ends in an encrypted .NET payload. The chain layers Kramer Python obfuscation, two Donut shellcode layers and a laZzzy shellcode-loader PE, so a signature for any single format misses the others. The author unpacked it with …