Loading story…
Zscaler ThreatLabz identified 2CLoader, a Windows malware loader observed in August 2026 delivering the Vidar and Remus information stealers and, in some cases, the XWorm RAT. The loader stores its configuration and encrypted payloads in PE resources, then applies layered rolling XOR, incremental XOR, AES-256-GCM encryption, SHA-256-derived key material, and optional Xpress Huffman decompression before execution. It supports in-memory .NET execution, manual PE loading, and RunPE/process hollowing.
2CLoader uses Hell’s Gate-style indirect system calls, anti-debugging and anti-VM checks, user-activity validation, single-instance locking, and optional API trampoline hooks to hinder analysis and alter environment information. It can persist through per-user Registry entries, Startup-folder placement, and scheduled tasks, while communicating with HTTP command-and-control infrastructure through XOR-encrypted JSON telemetry. Organizations should hunt for these persistence mechanisms and suspicious processes performing resource-based payload decryption, memory-only .NET loading, or process hollowing.
Pull IOCs and campaign context straight into your stack.
1 event from the most recent confirmed update back to the earliest known activity.
Zscaler ThreatLabz identified 2CLoader, a Windows malware loader with layered payload encryption and anti-analysis capabilities. It was observed delivering Vidar and Remus information stealers, as well as XWorm RAT.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that **DBatLoader**—also tracked as **ModiLoader** and **NatsoLoader**—has been used in multiple malware delivery campaigns that start with social engineering and end with remote-access trojans such as **Remcos RAT** and **Warzone RAT**. In one observed intrusion, a purchase-order themed malspam message carried an ISO attachment containing a Windows executable disguised with an Excel icon; after execution, the loader retrieved a **4.3 MB** base64 text file from **OneDrive**, decoded additional components on the host, and led to **TLSv1.3** command-and-control traffic with `146.70.158[.]105` over TCP `9138`, consistent with Remcos activity. Another sample abused **Discord** attachment URLs to fetch a second Delphi-based stage and ultimately deploy Warzone RAT, which communicated over TCP `1990`. Technical analyses describe DBatLoader as a **Delphi-based loader** that uses multilayer obfuscation, image steganography, and in-memory decoding before dropping batch scripts, DLLs, and executables into `C:\Users\Public\Libraries`. It establishes persistence through `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`, malicious shortcuts, and copied binaries, while some variants also abuse a **Mock Trusted Directories UAC bypass** and a relative-path DLL hijack involving `easinvoker.exe` and `netutils.dll` to gain elevated execution without a UAC prompt. Researchers said the malware commonly pulls later-stage payloads from public cloud services including **OneDrive**, **Google Drive**, and **Discord**, and has been seen distributing **Formbook**, **Netwire RAT**, **Remcos RAT**, and **Warzone RAT** against business users, including targets in Europe.
Aug 15, 2026
Financially motivated threat actors have abused an illicit copy of the commercial **Shellter Elite v11.0** evasion framework since late April 2025 to build a loader delivering Lumma Stealer, ARECHCLIENT2/SECTOP RAT, and the Rhadamanthys information stealer. The campaigns used file-hosting links, phishing lures aimed at content creators, and malicious YouTube comments to distribute payloads; a shared embedded license-expiry timestamp indicates many samples may have been produced using a single compromised or illicit license. The observed SHELLTER loader encrypts payloads with **AES-128-CBC** and employs polymorphic shellcode, `ntdll` remapping and unhooking, indirect system calls, call-stack corruption, AMSI bypasses, debugger and sandbox checks, and vectored-exception-handler API proxying to hinder detection and analysis. Elastic Security Labs released YARA rules and a dynamic unpacker to help defenders identify and inspect the malicious loader and its embedded malware.
Sep 9, 2026
Researchers reported continued evolution in two prominent malware loaders used for financially motivated intrusions: **SocGholish** and **BLISTER**. Elastic said newer BLISTER variants hide malicious code inside legitimate DLLs, including **VLC Media Player** libraries, and add stronger evasion such as domain-based environmental keying, configurable anti-debugging, revised configuration fields, and unhooking techniques aimed at bypassing userland syscall-based EDR visibility. CloudSEK’s earlier analysis showed BLISTER using code-signed components, `rundll32.exe`, process hollowing, and Startup-folder persistence to deliver payloads including **Raccoon Stealer**, **Cobalt Strike Beacon**, and **BitRAT**, while Elastic linked more recent activity to deployment of the **MYTHIC** implant and to an updated **SocGholish** infection chain. Red Canary reported that **SocGholish** also changed delivery patterns, using ZIP-delivered JavaScript with filename obfuscation and **UTF-8 Cyrillic homoglyphs** to evade string-based detections, while selectively delivering second-stage malware in a subset of infections. Observed follow-on activity included host reconnaissance, Python-based persistence, browser credential theft, NTLM hash harvesting through forced authentication, and in some cases reported progression to **RansomHub** ransomware. Separate incident reporting from ReliaQuest showed how another JavaScript-based loader, **Gootloader**, enabled a long-dwell intrusion that escalated from SEO-poisoning and ZIP-delivered script execution to **SystemBC** access, LDAP discovery, Kerberoasting, RDP lateral movement, credential dumping, and exfiltration, underscoring how modern loaders are being refined as stealthy entry points for credential theft, post-exploitation, and ransomware operations.
Aug 15, 2026