MovieReaper Stage-2 In-Memory COFF Load via module_init Export

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•2

Detects the initialization of COFF object files within a process memory context, characteristic of the MovieReaper stage-2 implant. This rule identifies the invocation of a 'module_init' exported function, which serves as a common mechanism for executing Beacon Object Files (BOF) or similar in-memory command loading interfaces.