Loading story…
Researchers detailed updated TerraLoader malware used in fake job-themed lures to deliver follow-on payloads including the JavaScript backdoor more_eggs and TerraStealer. The loader relied on heavily obfuscated JavaScript, layered decryption, and staged execution through Windows components such as msxsl.exe and cscript.exe, while also establishing persistence through the registry and task-scheduling artifacts. In one analyzed chain, a decoded DOC lure and a DLL were dropped, with the DLL reconstructing and writing the more_eggs payload to disk after unpacking embedded data from encrypted and compressed blobs.
The newer TerraLoader samples tied decryption to victim-specific system attributes including COMPUTERNAME and PROCESSOR_IDENTIFIER, making payload recovery and analysis harder outside the intended host. Analysts also observed RC4-based key brute forcing used as both obfuscation and a delay mechanism, anti-analysis checks for FLAREVM, chained exception handling for anti-debugging, and environmental checks using typeperf.exe. Configuration data recovered from the malware included a CloudFront-hosted gate URL, and researchers said the tooling showed signs of customized delivery for selected victims, with attribution assessments pointing more closely to Evilnum than FIN6, while another report linked maintenance of TerraLoader to BadBullzVenom.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
An analysis dated 2021-03-25 examined Terraloader as a JavaScript/XSL malware loader, detailing its obfuscation, persistence, anti-debugging, and victim-specific Killswitch behavior. The analysis also assessed the tooling and TTPs as more closely aligned with Evilnum than FIN6.
A later analysis documented an updated TerraLoader dropper DLL used to build and deliver the more_eggs JavaScript backdoor. It highlighted changes from XOR-based key brute forcing to RC4-based routines, host-specific decoding tied to COMPUTERNAME and PROCESSOR_IDENTIFIER, and embedded configuration including a CloudFront gate URL and scheduled-task artifacts.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
medium.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed two separate malware chains that rely on deeply layered staging, DLL sideloading, and trusted signed software to conceal execution. One campaign, dubbed **Eimeria**, starts from a `RAR5` archive containing the signed `dsclock.exe`, a malicious `zlibwapi.dll`, and an encrypted payload that decrypts into an IExpress package and then an AutoIt-based RunPE loader. The chain restores `ntdll.dll` to evade EDR hooks, decrypts later stages with `AES-128-CBC`, `RC4`, and `LZNT1`, hollows `explorer.exe`, `svchost.exe`, or `taskhostw.exe`, and injects a small .NET RAT that beacons over WebSocket to `94.26.90.139:3006`. It also sets persistence through a Run key and scheduled task and uses delays, sleep checks, and CPU and memory stress tests to frustrate analysis. A second intrusion set tied to **UAC-0184 / MB-0007** used Ukraine-themed lures and messenger delivery to target Ukrainian Defense Forces personnel, beginning with `LNK` files that called `bitsadmin` to fetch `HTA` content from `169.40.135.35` for execution via `mshta`. The downloaded archive abused legitimate Plane9 components for sideloading through `Cluster-Overlay64.exe`, `Plane9Engine.dll`, and `openvr_api.dll`, then decoded `kernel-diag.lib` into `evr.dll` and unpacked `filter.bin` by rebuilding `IDAT` chunks, XOR-decoding with key `0x227E9BDE`, and decompressing with `LZNT1`. The final bundle included signed utilities such as Microsoft-signed `VSLauncher.exe` and a renamed PassMark Endpoint DLL, indicating the actor likely repurposed a signed network stack and dump-capable tooling for covert internal communications, with controller details possibly discovered dynamically over multicast `224.0.0.255:31339` and TCP `31339` rather than a fixed external C2.
Jun 29, 2026
Researchers tied multiple malware components to **TrickBot-associated operations**, including a custom loader that fetched encoded payloads from GitHub files disguised as images and launched a 64-bit **Cobalt Strike** beacon directly in memory. The loader manually resolved APIs from `ntdll.dll` and `kernel32.dll`, loaded `wininet.dll`, and used HTTPS command-and-control on port `443`, with beacon configuration pointing to `rainbowmango.info` subdomains and `gpupdate.exe` configured as a spawn-to process. Separate analysis of **TrickLoader**, the TrickBot framework’s loader component, showed years of increasing obfuscation, including hidden resource names, custom Base64 schemes, compressed payloads, function-table reconstruction, and anti-analysis techniques such as UAC bypass and Heaven’s Gate. Additional reporting linked a newer **Krypton/Xenon crypter** and related data-exfiltration malware to the same ecosystem through a distinctive string-encoding pattern ending in `mOrxx` that had previously appeared in TrickBot tooling. Unpacked samples contained references to **Mimikatz**, a proof-of-concept for `CVE-2020-0787`, and downloads from `raw.githubusercontent.com`, while the exfiltration malware used WinINet APIs to upload stolen data to hard-coded `uploadFile.php` endpoints and also enumerated processes and collected desktop and window information. Investigators identified infrastructure including `temp.positiveseca.com`, `se1.buttonrich.com`, `figures.pablotech.info`, and `files.pablotech.info`, reinforcing links between TrickBot loaders, post-exploitation tooling, and data-theft activity.
Aug 14, 2026
Researchers identified **WordlistLoader** as a new malware loader used in **ClearFake** campaigns to deliver **Amatera Stealer** (also tracked as **ACR Stealer**) through compromised legitimate websites. Victims are shown **FakeCaptcha** overlays and tricked into running clipboard-delivered commands that abuse `conhost`, `cmd`, **WebDAV** shares, and `rundll32` to launch the loader. WordlistLoader then rebuilds shellcode from encoded English words or UUID fragments, unhooks modules, disables **ETW** logging with a hardware-breakpoint-based bypass, and executes shellcode that decrypts and reflectively loads Amatera. The campaign includes infrastructure such as command-and-control domains, dead-drop URLs, malware hashes, and compromised-site indicators. The activity also reflects a broader trend of commodity stealers adopting advanced Windows evasion methods more often associated with higher-end malware. Amatera’s newer builds add stronger static obfuscation, stealthier **WoW64** syscall invocation, and runtime-built x64 indirect syscall trampolines using **Heaven’s Gate**, a technique previously documented as a way to bypass user-mode hooks in the WoW64 subsystem. Its updated **Chromium Application-Bound Encryption** bypass also resembles methods seen in **Remus** and **Lumma**, underscoring how infostealer operators are rapidly incorporating sophisticated anti-detection and credential-theft capabilities into large-scale web-injection campaigns.
Aug 24, 2026