The analyzed malspam contained an attachment with a JavaScript file belonging to the LausivLoader malware family. The JavaScript creates a temporary directory and writes two large encoded strings into separate files, then sets process environment variables with the paths to these files. It launches a child process (conhost.exe) that runs PowerShell with an encoded command. The PowerShell script reads the file contents from the environment variable paths, combines and Base64-decodes them, then decrypts the data using AES-128-CBC with a hardcoded key and IV. The decrypted data is decompressed with GZipStream to yield a 315,904-byte 64-bit .NET executable payload. This multi-stage approach using environment variables for data handoff is unusual and complicates static and dynamic analysis. The malware uses obfuscation and layered encoding to evade detection and analysis.

Successful execution results in the deployment of a 64-bit .NET executable payload on the victim system. The malware's multi-stage design and use of encryption and compression protect the payload from detection and analysis. The environment variable-based data handoff technique may evade some detection mechanisms that do not track inter-process environment inheritance. The delivered payload could enable further malicious activity depending on its functionality, which is not detailed in the provided information.

No specific vendor advisory or patch information is provided. General mitigation includes blocking malspam at the gateway, enforcing SPF and DMARC to reduce spoofed emails, and quarantining suspicious attachments. Detection tools should consider the multi-stage nature of LausivLoader and monitor for unusual use of environment variables and PowerShell encoded commands. Analysts should be aware that partial command extraction may be insufficient for full analysis due to the environment-based data handoff. Patch status is not yet confirmed — check vendor advisories for updates.