The message instructed the recipient to forward a report for verification and open the attached ZIP file on their computer This article explores clue successful bcryptdecrypt. . The evidence provided does not support the claims of "smart filtering" or researcher-specific blocking mentioned in the headline.

This routine resolves Windows functions using hash-like identifiers, decodes data with XOR, transforms a 0x2bc0-byte region, and copies the result into executable memory. Dynamic analysis added a matching clue: a successful BCryptDecrypt operation produced an 11,200-byte buffer, equal to 0x2bc0 bytes. The decrypted data included the string "RAPID_CFG_START," the address 134.122.155.135, port 443, and a Chinese phrase meaning "Default group." The other fields remain unresolved.

During execution, both files were copied to %APPDATA%\Microsoft\Update\.

A registry write created the "MicrosoftUpdate" value under HKCU\Software\Microsoft\Windows\CurrentVersion\Run, allowing the staged executable to start again when the user logs in. Defenders should search for the two files in the roaming-profile update directory, the Run-key value pointing to that location, and repeated connections to that IP and port. That case used a signed Thunder executable and a malicious libexpat.dll to deliver ValleyRAT, but it was a different delivery chain, pelagos explained.

Microsoft has separately reported fake software-download sites in activity assessed as consistent with Silver Fox; its report does not establish that these sites were part of this WhatsApp delivery.