# OXLOADER Malware Loader Delivering CASTLESTEALER .NET Infostealer via Node.js Malvertising

> OXLOADER is a heavily obfuscated Windows loader that uses control-flow flattening, module stomping, and extensive anti-analysis to stage DonutLoader, which deploys the CASTLESTEALER .NET infostealer in memory. The campaign was distributed through malicious Google Ads impersonating Node.js and is attributed by Elastic Security Labs to a financially motivated, Russian-speaking actor; the malvertising infrastructure was dismantled on 2026-05-14.

- **Published:** 2026-06-18T00:00:00Z
- **Last reviewed:** 2026-06-18T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0857
- **ID:** TL-2026-0857
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 24 (full data via the Threadlinqs MCP server — Purple tier)

## Description

OXLOADER is a multi-stage Windows loader documented by Elastic Security Labs (published 2026-06-19) that culminates in the in-memory execution of CASTLESTEALER, a custom .NET information stealer. Initial access is achieved through malvertising: malicious Google Ads impersonating the Node.js project lure victims to the landing page node-js.prentiva99.info, which redirects through app.miloyannopoulos.com/download?subid1=download and ultimately serves a Windows batch script hosted on the abused Storj service link.storjshare.io. The batch script launches PowerShell with UAC elevation (-Verb RunAs) to execute OXLOADER, which masquerades as legitimate tooling using filenames such as apimonitor-x64.exe and node-v24.15.0-x64-86.exe.

OXLOADER is protected by a dense obfuscation stack: control-flow flattening, Mixed Boolean-Arithmetic (MBA) expressions, opaque predicates, function chunking across non-contiguous regions, indirect runtime-computed jumps, and self-modifying decryption stubs executed in three iterations across different memory regions. It resolves imports dynamically using Adler-32 API hashing. Before proceeding, OXLOADER runs an environment-evaluation battery designed to defeat sandboxes and avoid CIS-region systems: a WNetAddConnection2W emulation check using the malformed resource '*72s@1s' that expects ERROR_BAD_NAME (0x43); a minimum CPU count of 3; a minimum of 3 GB physical RAM via GlobalMemoryStatusEx; a display refresh rate of at least 20 Hz queried through WMI Win32_VideoController; a GetUserGeoID check that excludes CIS countries; and a GetUserDefaultUILanguage check that excludes Russian (0x419).

For execution OXLOADER performs module stomping: it copies C:\Windows\System32\dui70.dll to a temporary path with a random name and an .ocx extension, adds a new RWX section named .xtext, abuses the .reloc section to house malicious code in place of legitimate relocation entries, and loads the modified DLL via LoadLibraryA. It then stages shellcode generated with DonutLoader, which wraps the CASTLESTEALER .NET assembly into position-independent code, decompresses it with aPLib, and bootstraps via a RunPE() routine for reflective in-memory loading.

CASTLESTEALER is a .NET stealer that communicates with C2 servers at 89.124.95.161 and 89.124.115.82. Its strings and configuration are protected with the Chaskey-LTS block cipher in CTR mode (key 6E0A1F8F77F7011561F6F9CA96B71B8F, IV 956C6128E9362E075F8D006C93616A66) and an additional string XOR routine of the form a1 ^ (a2 + 0x33FDA). Elastic attributes the operation to a financially motivated, Russian-speaking threat actor based on CIS-region and Russian-language exclusions; the Google Ads registrant was recorded as 'ВОЛОДИМИР ТЕРЕЩЕНКО'. The ad campaign was last shown on 2026-04-23 and the supporting infrastructure was dismantled on 2026-05-14.

## MITRE ATT&CK

- T1583.008 Malvertising
- T1608.001 Upload Malware
- T1189 Drive-by Compromise
- T1204.002 Malicious File
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1548.002 Bypass User Account Control
- T1027.013 Encrypted/Encoded File
- T1140 Deobfuscate/Decode Files or Information
- T1036.005 Match Legitimate Resource Name or Location
- T1574.001 DLL
- T1497.001 System Checks
- T1620 Reflective Code Loading
- T1055 Process Injection
- T1082 System Information Discovery
- T1614.001 System Language Discovery
- T1614 System Location Discovery
- T1555.003 Credentials from Web Browsers
- T1005 Data from Local System
- T1071.001 Web Protocols
- T1573.001 Symmetric Cryptography
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel

## Sources

- [OXLOADER: A new malware loader delivering CASTLESTEALER](https://www.elastic.co/security-labs/oxloader-malware-loader-infostealer)
- [Elastic Security Labs — Malware analysis](https://www.elastic.co/security-labs/topics/malware-analysis)
- [MITRE ATT&CK — Malicious Advertising (T1583.008)](https://attack.mitre.org/techniques/T1583/008/)
- [MITRE ATT&CK — Reflective Code Loading (T1620)](https://attack.mitre.org/techniques/T1620/)
- [MITRE ATT&CK — Hijack Execution Flow: DLL Side-Loading (T1574.002)](https://attack.mitre.org/techniques/T1574/002/)
- [Threat actors misuse Node.js to deliver malware and other malicious payloads](https://www.microsoft.com/en-us/security/blog/2025/04/15/threat-actors-misuse-node-js-to-deliver-malware-and-other-malicious-payloads/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0857