{
  "name": "OXLOADER: new loader evading detection to drop infostealer",
  "slug": "oxloader-new-loader-evading-detection-to-drop-infostealer",
  "description": "A previously undocumented Windows loader designated as OXLOADER delivers the CASTLESTEALER infostealer through malicious Google Ads campaigns, achieving remarkably low detection rates. The loader employs multiple obfuscation layers including control-flow flattening, opaque predicates, and mixed Boolean-Arithmetic techniques, along with self-modifying decryption stubs and abuse of the Windows .reloc section for shellcode staging. Distribution occurs via malvertising impersonating Node.js installations, redirecting victims through intermediary domains to Storj-hosted batch scripts. The loader implements five anti-VM and language checks, including CIS-region and Russian-language exclusions, suggesting a financially motivated Russian-speaking threat actor. OXLOADER uses DonutLoader to deliver the .NET-based CASTLESTEALER payload in memory, evading traditional detection mechanisms through deliberate engineering choices.",
  "published": "2026-06-19T00:03:22.815000+00:00",
  "created_at": "2026-06-19T08:39:22.650000+00:00",
  "modified_at": null,
  "created_at_opencti": "2026-06-19T08:39:22.650000+00:00",
  "author": "AlienVault",
  "confidence": 100,
  "report_types": [
    "threat-report"
  ],
  "labels": [
    "anti-vm",
    "castlestealer",
    "donutloader",
    "google ads",
    "infostealer",
    "malvertising",
    "obfuscation",
    "oxloader",
    "reloc section abuse",
    "russian-speaking actor"
  ],
  "tags": [],
  "related_entities": {
    "indicators": [
      {
        "id": "c5f79af5-8f3e-4207-9c98-7926dc2527c1",
        "name": "https://link.storjshare.io/raw/jv5uebuqwzfpmtahj34q753ptykq/node/BATPackageBulderSetup.bat"
      },
      {
        "id": "fe7c4829-7a2f-47aa-9b3a-c3b17ab09723",
        "name": "http://app.miloyannopoulos.com/download?subid1=download"
      },
      {
        "id": "ad37472c-4064-4a0f-8276-f6c4c42b4cd4",
        "name": "http://app.miloyannopoulos.com/download"
      },
      {
        "id": "47e76f87-090f-477e-8c37-90fdaa922433",
        "name": "de4f51649ec1a33071854aefe93ffb3fc225e19f802d8dd914676dd5dfef2615"
      },
      {
        "id": "1694fe2e-e86e-4522-90a8-e6fefdeca0e4",
        "name": "c85f2765a6c3c3f3907c17e57df12f8f68826f74bff3bbfd272af50666d065fe"
      },
      {
        "id": "1fd241fc-8136-4e39-add6-2f2e8578d169",
        "name": "39019279686c820c3af5684012a0085a7e2109f612c9fab886dd0577ace5b5c6"
      },
      {
        "id": "c8f9e03e-0253-4c00-9678-588dd09abfa2",
        "name": "fdfc7831e5c24cfa80152860dfe8c056ba079f7df1393bf6bb7b18ed974eda37"
      },
      {
        "id": "d1a06261-4985-49f0-921f-4385d517d125",
        "name": "https://link.storjshare.io/raw/jvsmdybqmvwep2oawbobp6ub7aza/node/node-v24.15.0-x64-86.exe"
      },
      {
        "id": "e8563a33-524b-44f7-9cd6-bbda67fc805f",
        "name": "9a9939dff297997732aaade9b243d695632cbd64033c5fbcb9de3d09b7e6c28d"
      },
      {
        "id": "9a6a2740-fd42-4fa1-a504-80bfd61f5ef7",
        "name": "http://link.storjshare.io/raw/jwwvr4oskkkjsgevt774ta62ehya/ruslan/aBsvwbdas.exe"
      },
      {
        "id": "d1f421ad-c745-4747-b2ab-ba998c972242",
        "name": "http://link.storjshare.io/raw/jux4e4ky5mruo4jkxsssp42sau4q/ruslan/BATPackageBuilderSetup.bat"
      },
      {
        "id": "6076139b-c75e-4b76-b64f-1b18c0dda19d",
        "name": "node-js.prentiva99.info"
      },
      {
        "id": "5f710d95-1f39-42c4-bdbf-76c9c30c2b71",
        "name": "4ec9d9d4d10ad78fc6d7bda7cb17d52984878ccd2dd4302fd1cef152313b9741"
      }
    ],
    "malware": [
      {
        "id": "8184fb33-b978-4407-b88e-fdd1fdf81c79",
        "name": "DonutLoader",
        "slug": "donutloader"
      },
      {
        "id": "afe6e03e-de3e-4de8-9d25-0598bb953e86",
        "name": "CASTLESTEALER",
        "slug": "castlestealer"
      },
      {
        "id": "90761084-4bb7-481a-a5cc-9b50aa9d969b",
        "name": "OXLOADER",
        "slug": "oxloader"
      }
    ],
    "observables": [
      {
        "id": "201f9b4d-f344-45fb-b4cd-105984a7b693",
        "name": "node-js.prentiva99.info"
      },
      {
        "id": "7a6d0dcc-0574-4bdb-bfd1-28ecc58581d7",
        "name": "https://link.storjshare.io/raw/jvsmdybqmvwep2oawbobp6ub7aza/node/node-v24.15.0-x64-86.exe"
      },
      {
        "id": "637ebd7a-3a2e-4468-97e0-6c882a115144",
        "name": "http://link.storjshare.io/raw/jux4e4ky5mruo4jkxsssp42sau4q/ruslan/BATPackageBuilderSetup.bat"
      },
      {
        "id": "82e97f09-0312-485f-a396-c3f9bf9a5668",
        "name": "http://app.miloyannopoulos.com/download"
      },
      {
        "id": "290c434d-22b7-4902-8b8b-d84edaadf207",
        "name": "https://link.storjshare.io/raw/jv5uebuqwzfpmtahj34q753ptykq/node/BATPackageBulderSetup.bat"
      },
      {
        "id": "c7ca5ca9-f11f-4bae-8e1e-40724bc96852",
        "name": "http://link.storjshare.io/raw/jwwvr4oskkkjsgevt774ta62ehya/ruslan/aBsvwbdas.exe"
      },
      {
        "id": "e956c911-3941-4e71-b05d-adf621a08de3",
        "name": "http://app.miloyannopoulos.com/download?subid1=download"
      }
    ]
  },
  "external_refs": [
    {
      "id": "cc6bd813-0d19-4948-9627-08705d43aa37",
      "standard_id": "external-reference--1540e2dc-3cfc-5da8-9333-8ea3fbce5a1d",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://www.elastic.co/security-labs/oxloader-malware-loader-infostealer",
      "hash": null,
      "external_id": null,
      "created": "2026-06-19T08:39:19.716Z",
      "modified": "2026-06-19T08:39:19.716Z",
      "createdById": null
    },
    {
      "id": "1f594431-baab-4a37-a225-7c19890868fe",
      "standard_id": "external-reference--b0ecac72-d8ce-59f0-a18f-105b26ecdcf2",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://otx.alienvault.com/pulse/6a34874a45b9c09ee90c0aff",
      "hash": null,
      "external_id": "6a34874a45b9c09ee90c0aff",
      "created": "2026-06-19T08:39:19.690Z",
      "modified": "2026-06-19T08:39:19.690Z",
      "createdById": null
    }
  ]
}