Key points
- The chain begins with cli2update2.exe, which downloads and loads pz2.bin before repeatedly checking for Steam, QQ and WeGame or TGP processes.
- Its branches combine process-memory access, DLL injection, JWT payload decoding, and a normal QQ login redirect to obtain sensitive session data.
- Conditional execution and memory-based payload loading mean that file scans or isolated alerts may not reveal the complete attack chain.
Context
The report presents a reverse-engineered malware chain rather than evidence that a particular organization was compromised. It documents process discovery, periodic dispatch, platform-specific collection and exfiltration behavior in unusual detail. Account logs and device forensics would be needed to establish whether an individual system suffered an actual loss.
What this means for you
Directly applicable
Developers and technical decision-makers can use the documented process checks, conditional branches and payload-loading pattern to test whether similar collection paths exist in mature or legacy environments.
Who benefits: Developers and technical decision-makers benefit when they can connect process-level malware behavior to monitoring gaps, access controls and legacy application boundaries.
The site can support reviews of legacy architecture and monitoring controls that reveal where process discovery, memory loading and credential collection could evade isolated file-based checks.