Elastic Details OXLOADER Loader Delivering CASTLESTEALER Through Malicious Ads
Summary
Elastic Security Labs details OXLOADER, a Windows loader delivered through malicious Google Ads and Storj-hosted files to deploy CASTLESTEALER. Analysis describes its obfuscation, environment checks, .reloc shellcode staging, and in-memory payload execution.
Key points
- Malicious Google Ads impersonating Node.js downloads redirected users to Storj-hosted scripts and executables that delivered OXLOADER.
- OXLOADER uses layered obfuscation, runtime decryption, and self-modifying code to hinder static analysis.
- The loader checks system resources, display settings, geography, language, and a network error result to avoid analysis environments; it excludes CIS regions and Russian-language systems.
- It places shellcode in a DLL’s .reloc section, then copies it to an executable section in a temporary .ocx-named file.
- The next stage uses DonutLoader, Chaskey-LTS decryption, and aPLib decompression to execute CASTLESTEALER in memory.
- Elastic observed the campaign targeting a customer and detected malicious behavior; the reported detection policy was set to detect only.
- CIS-region and Russian-language exclusions led Elastic to assess the activity as possibly financially motivated and Russian-speaking; the advertiser’s identity as the actual operator remains unclear.
Article Details
- Attack Vectors
- Malicious Google Ads impersonated Node.js downloads and directed users to a landing page and redirector.
- The redirector sent victims to Storj-hosted batch scripts and executables that downloaded and launched OXLOADER.
- OXLOADER staged shellcode through a modified .reloc section and delivered CASTLESTEALER for in-memory execution.
- Defensive Notes
- Elastic Defend detected malicious behavior in the observed customer environment; the article states the policy was set to detect only.
- Elastic Security created YARA rules to identify the activity.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | app[.]miloyannopoulos[.]com | Malvertising redirector that sent users to payload delivery URLs. |
| DOMAIN | node-js[.]prentiva99[.]info | Malicious landing page impersonating a Node.js download site. |
| IPV4 | 89[.]124[.]115[.]82 | CASTLESTEALER command-and-control server. |
| IPV4 | 89[.]124[.]95[.]161 | CASTLESTEALER command-and-control server. |
| SHA256 | 39019279686c820c3af5684012a0085a7e2109f612c9fab886dd0577ace5b5c6 | SHA-256 associated with CASTLESTEALER. |
| SHA256 | 4ec9d9d4d10ad78fc6d7bda7cb17d52984878ccd2dd4302fd1cef152313b9741 | SHA-256 associated with CASTLESTEALER. |
| SHA256 | 9a9939dff297997732aaade9b243d695632cbd64033c5fbcb9de3d09b7e6c28d | SHA-256 of apimonitor-x64.exe, identified as OXLOADER. |
| SHA256 | c85f2765a6c3c3f3907c17e57df12f8f68826f74bff3bbfd272af50666d065fe | SHA-256 of node-v24.15.0-x64-86.exe, identified as OXLOADER. |
| SHA256 | de4f51649ec1a33071854aefe93ffb3fc225e19f802d8dd914676dd5dfef2615 | SHA-256 of BATPackageBulderSetup.bat, identified as an OXLOADER downloader and launcher. |
| SHA256 | fdfc7831e5c24cfa80152860dfe8c056ba079f7df1393bf6bb7b18ed974eda37 | SHA-256 of BATPackageBuilderSetup.bat, identified as an OXLOADER downloader and launcher. |
| URL | hxxps[:]//link[.]storjshare[.]io/raw/jv5uebuqwzfpmtahj34q753ptykq/node/BATPackageBulderSetup.bat | Specific Storj-hosted batch-script URL used in the OXLOADER delivery chain. |
| URL | hxxps[:]//link[.]storjshare[.]io/raw/jvsmdybqmvwep2oawbobp6ub7aza/node/node-v24.15.0-x64-86.exe | Specific Storj-hosted executable URL used to deliver an OXLOADER variant. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationOXLOADER uses layered obfuscation, including control-flow flattening, opaque predicates, mixed Boolean-Arithmetic, and function chunking.T1027.013 · Encrypted/Encoded FileThe loader decrypts embedded regions and configuration used to unpack and execute the next stage.T1027.016 · Junk Code InsertionThe Node.js-themed variant includes dummy CMake-related strings that disguise its purpose.T1055 · Process InjectionThe next-stage shellcode bootstraps CASTLESTEALER through DonutLoader's RunPE function for in-memory execution.T1082 · System Information DiscoveryOXLOADER checks CPU count, physical memory, display refresh rate, geographic region, and language before continuing.T1106 · Native APIThe loader calls Windows APIs including WNetAddConnection2W, GlobalMemoryStatusEx, GetUserGeoID, and GetUserDefaultUILanguage.T1140 · Deobfuscate/Decode Files or InformationOXLOADER decrypts strings and code at runtime, including embedded configuration decrypted with Chaskey-LTS.T1204.002 · Malicious FileThe infection chain required a victim to click a sponsored result and execute downloaded files.T1497.001 · System ChecksThe loader uses system and environment checks, including CPU, RAM, and display thresholds, to avoid sandbox or virtualized analysis environments.
Malware
CastleStealerElastic Security Labs identified OXLOADER, a previously undocumented Windows loader, delivering CASTLESTEALER through malicious Google Ads and Storj-hosted staging files.OXLOADERElastic Security Labs identified OXLOADER, a previously undocumented Windows loader, delivering CASTLESTEALER through malicious Google Ads and Storj-hosted staging files.
Vendors
Products
Elastic DefendElastic Defend detected malicious behavior and prevented the full attack chain in the observed customer environment.Microsoft WindowsElastic Security Labs identified OXLOADER, a previously undocumented Windows loader, delivering CASTLESTEALER through malicious Google Ads and Storj-hosted staging files.Node.jsThe campaign uses heavy obfuscation, anti-VM checks, and .reloc-based shellcode staging, while targeting users with Node.js-themed lures and low-detection payloads.
Tools
DonutLoader[T1055 ] Process Injection – The payload was bootstrapped for in-memory execution through DonutLoader and RunPE, indicating injected execution flow (‘bootstrapped through DonutLoader’s RunPE() function’).IDA ProOXLOADER breaks automated function-boundary detection in binary analysis tooling such as IDA Pro using four layered obfuscation techniques: control-flow flattening (CFF), mixed Boolean-Arithmetic (MBA), opaqueYARAElastic Security has created YARA rules to identify this activity.