OysterLoader Evasion Tactics Exposed: Advanced Obfuscation and Rhysida Ransomware Ties Uncovered
OysterLoader, also known as Broomstick and CleanUp, is a multi-stage loader malware developed in C++ and associated with the Rhysida ransomware group. This malware has been identified in various campaigns using trojanized installers for popular IT tools…
OysterLoader, also known as Broomstick and CleanUp, is a multi-stage loader malware developed in C++ and associated with the Rhysida ransomware group. This malware has been identified in various campaigns using trojanized installers for popular IT tools such as PuTTY, WinSCP, and Google Authenticator. It disguises itself as legitimate software to gain initial access to victim systems.
Once executed, OysterLoader establishes a foothold that can lead to the deployment of Rhysida ransomware or commodity info-stealers like Vidar. The malware is part of the broader WIZARD SPIDER/Vanilla Tempest ecosystem, which uses fraudulent code-signing certificates and malicious ad infrastructure to sustain campaigns.
The malware employs a four-stage infection chain beginning with a seemingly legitimate Microsoft Installer (MSI) package, often signed to bypass trust checks. The initial stage acts as a packer/obfuscator, loading subsequent stages from a "shuffled" blob in memory and using excessive Windows API calls to mislead static and heuristic engines. This stage also includes simple anti-debugging measures.
Stage two involves shellcode that decompresses a shared structure from the first stage and resolves imports dynamically. Stage three serves as a downloader and environment verifier, communicating with the first C2 layer using HTTPS endpoints and steganography to hide the next stage.
OysterLoader, also known as Broomstick and CleanUp, is a multi-stage loader malware developed in C++ and associated with the Rhysida ransomware group.
The final stage utilizes a plain-HTTP C2 protocol, evolving from IP-based to domain-based infrastructure. It implements custom encoding techniques and adapts its command traffic to evade static detection.
OysterLoader's command traffic is encoded using a non-standard Base64 alphabet, combined with a per-message shift from a PRNG, which complicates payload inspection. Newer versions enhance system fingerprinting and allow dynamic updates to the Base64 alphabet, improving resilience against static detection.
To counteract OysterLoader, defenders should monitor for signed MSI installers from untrusted sources, detect abnormal API behavior, and track its characteristic C2 paths and encoded JSON patterns. Network and endpoint telemetry focused on Rhysida-linked malvertising and C2 exchanges can enhance early detection.
Based on reporting by GBHackers.