SLOTAGENT Obfuscation Tactics Challenge Security Researchers

SLOTAGENT is a sophisticated Remote Access Trojan delivered via a malicious ZIP that launches a loader (WindowsOobeAppHost.AOT.exe / .dll), resolves Windows APIs via custom hashing, executes Beacon Object File payloads in-memory, and employs timestomping and string encryption (TEA-like) plus DJB2/ROR11 hashing to evade analysis; it communicates over TCP to hardcoded C2 43.156.59.110:699 using a JSON-based protocol and analysts published an IDAPython script to statically decrypt its strings.