2CLoader: A New Malware Loader Delivering Vidar and Remus

2CLoader is a newly identified malware loader active since August 2026 that delivers information stealers such as Vidar and Remus, as well as the XWorm RAT. It features advanced anti-analysis and evasion techniques, including anti-VM, anti-debug, indirect system calls via Hell's Gate, and inline trampoline hooks to bypass endpoint security. The loader protects its payloads with rolling XOR and AES-GCM encryption stored as PE resources and supports multiple execution methods. It communicates with command-and-control servers using encrypted JSON over HTTP POST and maintains persistence through registry keys, scheduled tasks, and startup folders.

• Peeling Back the Layers: Inside Vidar · From Virtualized Code to Stolen CredentialsMalware2026-09-09
• September 2026 Infostealer Trend ReportMalware2026-10-28
• Warden Stealer: The Rapid Rise of an Infostealer with an Appetite for AI Agent DataMalware2026-10-09
• August 2026 Infostealer Trend ReportMalware2026-09-22
• Vidar Adds Virtual Machine and Custom Stream Ciphers For String ObfuscationMalware2026-09-21