🎯 API hashing

The items that name it 2

• NeedyMantis: Unpacking a post-compromise malware family used in targeted operations
  writeup2026-09-28

  Second-stage loader resolves Windows API hashes using a configurable rotate-right (ROR) algorithm (observed rotation value 11)

• ClickFix Removes Your Background but Leaves the Malware
  writeup2026-04-30It is written here as API hashing (djb2 and custom alternating-step hash).

  Shellcode and CastleLoader resolve APIs by hash instead of by name; djb2 (init 5381, *33+byte) in shellcode #1, custom alternating-step 0xAAAAAAAA-seeded hash in CastleLoader