C2Looper shell staging file c2_out.txt creation

Emiliano Mema@Nosalva

•updated Aug 19, 2026•4•0•8

Detects the creation of a file named 'c2_out.txt' in common temporary or user directories ('\Users\', '\Temp\', or '\AppData\') shortly after a 'cmd.exe' process execution on the same device. This behavior is indicative of a potential command-and-control (C2) activity where output from malicious shell commands is being saved to a file.