# 2CLoader: New Malware Loader Delivering Vidar, Remus and XWorm

> Zscaler ThreatLabz analyzed 2CLoader, a new Windows malware loader first identified in August 2026 that delivers the Vidar and Remus information stealers and the XWorm RAT. It combines Hell's Gate indirect syscalls, layered XOR/AES-GCM payload decryption, extensive anti-VM/anti-debug checks and configurable persistence, and beacons to its C2 via XOR-encrypted HTTP POST.

- **Published:** 2026-09-30T00:00:00Z
- **Last reviewed:** 2026-09-30T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2819
- **ID:** TL-2026-2819
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 35 (full data via the Threadlinqs MCP server — Purple tier)

## Description

2CLoader is a previously undocumented Windows loader analyzed by Zscaler ThreatLabz (published 2026-09-30, first identified August 2026). The source does not state the initial access vector; the loader carries its payloads as PE resources inside the executable. Resource layout is [final payload][optional payload][optional MessageBox][0xDC-byte configuration with magic 2C 3D 4E 5F]. Delivered families are the Vidar and Remus information stealers and the XWorm RAT (secondary).

Strings are protected with inline XOR (key 0x37 in the analyzed sample). Native APIs (NtProtectVirtualMemory, NtUnmapViewOfSection, NtQueryInformationProcess, NtDelayExecution, NtSetContextThread, NtGetContextThread) are invoked through Hell's Gate indirect syscalls: the loader maps a fresh ntdll.dll from disk, extracts syscall numbers from stub patterns, and locates a 0F 05 C3 syscall gadget in the in-memory ntdll, falling back to GetProcAddress if initialization fails. The payload is decrypted in stages: two rolling-XOR layers, an AES key derived from the SHA-256 of the first executable section (.text) combined with XOR seeds from the configuration and validated by a byte-sum checksum (binding decryption to the unmodified binary), AES-GCM decryption, and optional Xpress Huffman decompression. An anti-emulation loop (3,000,000 iterations, fewer than 2,000,000 CPU cycles) corrupts the derived key.

Anti-analysis is configurable through an opt_flag bitmask: CPUID hypervisor and vendor checks (VMware, VirtualBox, KVM, Xen, Parallels and QEMU are blocked; Hyper-V is allowed), module/process/MAC/registry VM artifact checks, a 200 ms timing check, a score-based sandbox model (base 5, pass at 8 or more, using process count, CPU count, RAM, disk size, uptime, ProcessDebugPort, Recent-files count, screen resolution, username/computer name and cursor movement), IsDebuggerPresent/CheckRemoteDebuggerPresent and timing debugger checks, and a user-activity check (cursor movement, left click or Enter within 5 seconds). Optional inline trampoline hooks spoof the environment: InternetReadFile/WinHttpReadData results have the last two octets of IPv4 addresses randomized, RegQueryValueEx spoofs system info, GetUserName returns random names (admin, user, gamer, john, alex, player), and GetComputerName returns random DESKTOP-* names. A lock file at %TEMP%\aw_.lk enforces a single instance.

Payloads run through LoadPE (manual in-process PE mapping, command line spoofed to svchost.exe, new thread), RunPE (suspended dllhost.exe by default, a delete-pending temp file, SEC_IMAGE section via NtCreateSection, PEB image base fix-up and thread redirection) or CLR hosting via mscoree.dll for .NET assemblies. With flag 0x80 the secondary payload's process spoofs explorer.exe as its parent and enables SeDebugPrivilege. Persistence is selectable: HKCU Run and RunOnce values, a Startup folder copy, a LogonTrigger scheduled task (all named _SecurityHealthService.exe, masquerading as a Windows component), the HKCU\Software\Microsoft NT\CurrentVersion\Windows Load value (as written in the source) and HKCU\Environment UserInitMprLogonScript.

C2 uses HTTP POST to /api/beacon with a Chrome/127 user-agent and a JSON body XOR-encrypted with a static 32-byte key. The registration message carries the beacon ID, OS version, PID, elevation, opt flags, CPU count, RAM, locale, sample path and a process name (e.g. default.exe), followed by event messages. Observed infrastructure: C2 aware-cr1.com and payload host 62.60.226.185 (t0907.exe). Zscaler lists 20 sample hashes and detects the family as Win64.Loader.2CLoader. No CVE, threat actor or campaign attribution is stated in the source.

## MITRE ATT&CK

- T1622 Debugger Evasion
- T1480 Execution Guardrails
- T1497.001 System Checks
- T1497.003 Time Based Checks
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1055.012 Process Hollowing
- T1620 Reflective Code Loading
- T1036.005 Match Legitimate Resource Name or Location
- T1134.004 Parent PID Spoofing
- T1106 Native API
- T1547.001 Registry Run Keys / Startup Folder
- T1053.005 Scheduled Task
- T1037.001 Logon Script (Windows)
- T1071.001 Web Protocols
- T1573.001 Symmetric Cryptography
- T1112 Modify Registry
- T1685 Disable or Modify Tools
- T1055.002 Portable Executable Injection
- T1012 Query Registry
- T1057 Process Discovery
- T1082 System Information Discovery
- T1033 System Owner/User Discovery
- T1614 System Location Discovery
- T1132.001 Standard Encoding

## Sources

- [2CLoader: A New Malware Loader Delivering Vidar and Remus (Zscaler ThreatLabz)](https://www.zscaler.com/blogs/security-research/2cloader-new-malware-loader-delivering-vidar-and-remus)
- [MITRE ATT&CK T1106 Native API](https://attack.mitre.org/techniques/T1106/)
- [MITRE ATT&CK T1055.012 Process Hollowing](https://attack.mitre.org/techniques/T1055/012/)
- [MITRE ATT&CK T1134.004 Parent PID Spoofing](https://attack.mitre.org/techniques/T1134/004/)
- [MITRE ATT&CK T1497 Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497/)
- [XWorm's Shape-Shifting Arsenal: Loader and Stager Variants in the Wild (Splunk)](https://www.splunk.com/en_us/blog/security/xworm-shape-shifting-arsenal-detection-evasion)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2819