SloppyRAT Hell's Gate Indirect Syscall via DJB2 API Hashing

Ibrahim Saud@tektrix

•updated Sep 19, 2026•0•0•2

Detects the loading of the hostfxr.dll module, the presence of the DLLMemLoader string in command lines, or the execution of python or pythonw processes. These patterns are often associated with the loading of malicious assemblies or execution via scripting environments.