MalwarePublished 19 Jun 2026

OXLOADER: new loader evading detection to drop infostealer

Source AlienVault OTX General

Description

A previously undocumented Windows loader designated as OXLOADER delivers the CASTLESTEALER infostealer through malicious Google Ads campaigns, achieving remarkably low detection rates. The loader employs multiple obfuscation layers including control-flow flattening, opaque predicates, and mixed Boolean-Arithmetic techniques, along with self-modifying decryption stubs and abuse of the Windows .reloc section for shellcode staging. Distribution occurs via malvertising impersonating Node.js installations, redirecting victims through intermediary domains to Storj-hosted batch scripts. The loader implements five anti-VM and language checks, including CIS-region and Russian-language exclusions, suggesting a financially motivated Russian-speaking threat actor. OXLOADER uses DonutLoader to deliver the .NET-based CASTLESTEALER payload in memory, evading traditional detection mechanisms through deliberate engineering choices.

Impact

The impact of OXLOADER is the delivery and execution of the CASTLESTEALER infostealer on infected Windows systems. This results in the potential theft of sensitive information from victims. The loader's advanced evasion techniques reduce the likelihood of detection by traditional security solutions, increasing the risk of successful compromise. The use of malvertising campaigns for distribution broadens the potential victim pool. The anti-VM and language checks limit exposure to certain regions, focusing the threat on specific targets. There are no known exploits in the wild beyond this campaign, and no official patches or fixes exist since this is malware.

Defensive guidance

As this is malware distributed via malvertising campaigns, there are no patches or official fixes available. Organizations should focus on blocking known indicators of compromise such as the provided hashes, URLs, and domains associated with OXLOADER. Security teams should update detection signatures to identify the obfuscation techniques and payload behaviors described. User awareness training to avoid downloading software from untrusted sources, especially via suspicious ads, is recommended. Network defenses should consider blocking access to the identified malicious domains and URLs. Since the malware uses anti-VM and language checks, monitoring for unusual execution environments may help detect attempts. No vendor advisory indicates that no action is required or that the threat is already mitigated.

Indicators of compromise

Domains 1

node-js.prentiva99.info

URLs 6

http://app.miloyannopoulos.com/download
http://app.miloyannopoulos.com/download?subid1=download
http://link.storjshare.io/raw/jux4e4ky5mruo4jkxsssp42sau4q/ruslan/BATPackageBuilderSetup.bat
http://link.storjshare.io/raw/jwwvr4oskkkjsgevt774ta62ehya/ruslan/aBsvwbdas.exe
https://link.storjshare.io/raw/jv5uebuqwzfpmtahj34q753ptykq/node/BATPackageBulderSetup.bat
https://link.storjshare.io/raw/jvsmdybqmvwep2oawbobp6ub7aza/node/node-v24.15.0-x64-86.exe

Hashes 10

6e0a1f8f77f7011561f6f9ca96b71b8f
77cc3c0fecc58b5b696f08858a214969
956c6128e9362e075f8d006c93616a66
1591ab9bf31f3e22555dd2320d9ab386d8f3a4b8
39019279686c820c3af5684012a0085a7e2109f612c9fab886dd0577ace5b5c6
4ec9d9d4d10ad78fc6d7bda7cb17d52984878ccd2dd4302fd1cef152313b9741
9a9939dff297997732aaade9b243d695632cbd64033c5fbcb9de3d09b7e6c28d
c85f2765a6c3c3f3907c17e57df12f8f68826f74bff3bbfd272af50666d065fe
de4f51649ec1a33071854aefe93ffb3fc225e19f802d8dd914676dd5dfef2615
fdfc7831e5c24cfa80152860dfe8c056ba079f7df1393bf6bb7b18ed974eda37

Community reviews

Loading reviews…