BendyBear: Chinese shellcode linked with cyber espionage group BlackTech

The BendyBear sample was determined to be x64 shellcode for a stage-zero implant whose sole function is to download a more robust implant from a command and control (C2) server.