Loading story…
Researchers identified DOUBLELOADER, a generic Windows backdoor observed in infections alongside the RHADAMANTHYS infostealer. The malware gathers host information, checks for updated versions of itself, injects unbacked code into explorer.exe via NtOpenProcess, NtWriteVirtualMemory, and NtCreateThreadEx, and communicates with the hardcoded address 185.147.125.81.
DOUBLELOADER is protected with the open-source ALCATRAZ obfuscator, identifiable in part by its .0Dev executable section. ALCATRAZ impedes analysis through obfuscated entry points, anti-disassembly jumps, instruction mutation, hidden constants, and control-flow flattening; researchers demonstrated deobfuscation using binary patching, pattern matching, emulation, IDA Python, and the D810 IDA plugin, and published a YARA rule to help detect the malware.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
The open-source ALCATRAZ binary-to-binary obfuscator was initially released. The tool originated in the game-hacking community and was later observed in e-crime and targeted-intrusion activity.
A YARA rule named Windows.Trojan.DoubleLoader was created to identify DOUBLELOADER activity.
Analysis identified the nonstandard .0Dev PE section in DOUBLELOADER samples as a toolmark of the ALCATRAZ obfuscator, which uses techniques including entrypoint obfuscation, anti-disassembly, instruction mutation, constant hiding, and control-flow flattening.
Researchers began observing the Windows backdoor DOUBLELOADER in infections alongside the RHADAMANTHYS infostealer. The backdoor injects unbacked code into explorer.exe, collects host data, requests updates, and beacons to 185.147.125.81.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Zscaler ThreatLabz identified **2CLoader**, a Windows malware loader observed in August 2026 delivering the Vidar and Remus information stealers and, in some cases, the XWorm RAT. The loader stores its configuration and encrypted payloads in PE resources, then applies layered rolling XOR, incremental XOR, AES-256-GCM encryption, SHA-256-derived key material, and optional Xpress Huffman decompression before execution. It supports in-memory .NET execution, manual PE loading, and RunPE/process hollowing. 2CLoader uses Hell’s Gate-style indirect system calls, anti-debugging and anti-VM checks, user-activity validation, single-instance locking, and optional API trampoline hooks to hinder analysis and alter environment information. It can persist through per-user Registry entries, Startup-folder placement, and scheduled tasks, while communicating with HTTP command-and-control infrastructure through XOR-encrypted JSON telemetry. Organizations should hunt for these persistence mechanisms and suspicious processes performing resource-based payload decryption, memory-only .NET loading, or process hollowing.
Sep 30, 2026
Researchers detailed updated **TerraLoader** malware used in fake job-themed lures to deliver follow-on payloads including the JavaScript backdoor **more_eggs** and **TerraStealer**. The loader relied on heavily obfuscated JavaScript, layered decryption, and staged execution through Windows components such as `msxsl.exe` and `cscript.exe`, while also establishing persistence through the registry and task-scheduling artifacts. In one analyzed chain, a decoded DOC lure and a DLL were dropped, with the DLL reconstructing and writing the **more_eggs** payload to disk after unpacking embedded data from encrypted and compressed blobs. The newer TerraLoader samples tied decryption to victim-specific system attributes including **`COMPUTERNAME`** and **`PROCESSOR_IDENTIFIER`**, making payload recovery and analysis harder outside the intended host. Analysts also observed RC4-based key brute forcing used as both obfuscation and a delay mechanism, anti-analysis checks for **`FLAREVM`**, chained exception handling for anti-debugging, and environmental checks using `typeperf.exe`. Configuration data recovered from the malware included a **CloudFront-hosted gate URL**, and researchers said the tooling showed signs of customized delivery for selected victims, with attribution assessments pointing more closely to **Evilnum** than **FIN6**, while another report linked maintenance of TerraLoader to **BadBullzVenom**.
Aug 15, 2026
Elastic Security Labs identified **OXLOADER**, a previously undocumented Windows loader used in a malvertising campaign to deploy the **CASTLESTEALER** information stealer. Malicious Google Ads impersonating Node.js redirected primarily U.S.-based targets through a redirector to Storj-hosted batch scripts, which downloaded OXLOADER and attempted to elevate its privileges. Geographic exclusions for Commonwealth of Independent States countries and Russian-language systems indicate a likely financially motivated, Russian-speaking operator. OXLOADER uses layered obfuscation, self-modifying decryption stubs, anti-sandbox checks, and runtime API resolution to evade detection. It stages shellcode in a PE file's `.reloc` section, adds an RWX `.xtext` section to a copied Windows DLL for execution, and uses DonutLoader to execute CASTLESTEALER as an in-memory .NET payload. The operation illustrates MITRE ATT&CK **Resource Development** activity, including malvertising, acquired hosting, and staged malware capabilities; Elastic reported low static and sandbox detection rates and released YARA rules and indicators for detection.
Sep 9, 2026