OysterLoader Mutex Suffix Detection

Ethan Andrews@eandrews

•updated Feb 12, 2026•6•0•43

Detects the creation of a mutex with a persistent suffix '!&fse?%AS!'. This string has been observed across multiple versions and campaigns of OysterLoader (also known as Broomstick/CleanUp).