BazLoader, Amadey, and StealC V2 Chain Targets Algeria and Italy via Single German /24

A 170 KB dropper identified as BazLoader/egairtigado initiates a three-stage loader chain that deploys Amadey and then stages StealC V2 credential harvesting, with all C2 traffic routed to two IP addresses inside a single /24 subnet under AS214351 in Germany. The campaign carries an espionage motivation tag and is associated with the WoodyRAT malware family, with regional targeting logged against Algeria and Italy. A self-signed 'PureCrack' TLS certificate valid until 2036 and raw-IP HTTP beaconing that bypasses DNS entirely define the operational signature.