A new shellcode in the wild

Zscaler ThreatLabZ analyzes a.NET sample that uses the "Frenchy" shellcode—identified by a mutex name like "frenchy_shellcode_{version}"—to perform hollow process injection and load AES-encrypted payloads; the report details resource extraction, environment checks, persistence (AppData Tasks copy, VBS and URL startup), DLL mapping to evade API monitoring, and lists numerous affected malware families and associated MD5 indicators.