OysterLoader Multi‑Stage Evasion Loader Uncovered with Advanced Obfuscation and Rhysida Ransomware Links
OysterLoader is a sophisticated malware loader that has emerged as a significant threat within the cybersecurity landscape. It employs multiple layers of obfuscation to evade detection and deliver harmful payloads.
OysterLoader is a sophisticated malware loader that has emerged as a significant threat within the cybersecurity landscape. It employs multiple layers of obfuscation to evade detection and deliver harmful payloads.
Identified in June 2024 by Rapid7, this C++ malware is primarily distributed through fake websites that impersonate legitimate software such as PuTTy, WinSCP, Google Authenticator, and various AI tools. The malware masquerades as Microsoft Installer (MSI) files, often digitally signed, making them appear legitimate to unsuspecting users.
OysterLoader operates through a complex four-stage infection chain, beginning with a TextShell packer, progressing through custom shellcode execution, and culminating in the delivery of the core malicious payload. It is primarily associated with Rhysida ransomware campaigns but has also been observed distributing commodity malware like Vidar, a widespread infostealer as of January 2026. The connection to the Rhysida ransomware group, linked to the WIZARD SPIDER threat actor nebula, highlights the threat's severity.
OysterLoader is a sophisticated malware loader that has emerged as a significant threat within the cybersecurity landscape.
Sekoia analysts have identified that OysterLoader maintains a two-tiered command and control infrastructure, with delivery servers managing initial connections and final C2 servers handling victim interactions. The malware exhibits advanced anti-analysis capabilities, including API hammering, dynamic API resolution through custom hashing algorithms, and timing-based sandbox detection. Its developers have continuously updated its code, communication protocols, and obfuscation techniques to maintain effectiveness against security solutions.
Advanced Infection Mechanism and Steganography Techniques
The infection process of OysterLoader demonstrates remarkable technical sophistication in concealing and deploying its malicious components. After verifying that the infected system has at least 60 running processes, the malware establishes communication with command and control servers over HTTPS. During this phase, it employs steganography to hide the next-stage payload within icon image files, disguising malicious code as legitimate visual content.
The malware uses RC4 encryption with a hardcoded key to protect the embedded payload within these image files. This payload is concealed after a specific marker pattern labeled "endico," challenging detection through conventional security tools. Once decrypted, the payload is written as a DLL file to the user's AppData directory and executed through scheduled tasks running every 13 minutes, ensuring persistent access to compromised systems. Communication employs custom JSON encoding with a non-standard Base64 alphabet and random shift values, complicating network traffic analysis for security teams monitoring infected environments.
Based on reporting by Cyber Security News.