2CLoader Malware Evades Detection to Deploy Vidar and Remus Stealers

Key Takeaways

• 2CLoader is a novel malware loader designed to deploy credential stealers and Remote Access Trojans (RATs) on Windows systems.
• First observed in August 2026, it primarily facilitates the distribution of Vidar and Remus information stealers, as well as XWorm RAT.
• The malware employs sophisticated evasion techniques, including encrypted payloads, indirect system calls, and anti-analysis checks, to bypass security tools.
• Its modular design allows for flexible payload delivery and persistence mechanisms, making detection and removal challenging.
• Organizations should implement robust endpoint and network monitoring and prioritize patching to mitigate risks.

New 2CLoader Malware Evades Security Tools

A recently identified malware loader, dubbed 2CLoader, is actively being used by threat actors to install credential-stealing programs on Windows machines. This sophisticated loader, first detected in August 2026, has been instrumental in disseminating notorious information stealers like Vidar and Remus, alongside the XWorm Remote Access Trojan (RAT). These malicious payloads are designed to exfiltrate sensitive data, including saved passwords, browser histories, session tokens, and other critical information that can lead to further system compromise. The discovery of 2CLoader’s operational tactics was made by researchers at Zscaler, who analyzed various samples and delivery methods.

Zscaler said in a report shared with Cyber Security News (CSN) that 2CLoader incorporates a range of checks and execution options, enabling its operators to customize its behavior on targeted devices. The effectiveness of a loader like 2CLoader highlights the critical role such components play in successful malware campaigns. By delaying payload decryption until late in the execution chain and adapting its actions when it detects analysis environments, 2CLoader significantly increases the likelihood that its embedded theft tools will reach legitimate users without detection.

Advanced Evasion Techniques

2CLoader employs several advanced techniques to evade detection. It encrypts its strings and embeds its configuration and payload within a Windows executable resource. The malware utilizes a combination of rolling XOR and AES-GCM decryption, with the final decryption key dynamically linked to the loader’s own code. This intricate encryption scheme makes static analysis considerably more difficult.

Furthermore, the malware leverages indirect system calls for Windows functions that are frequently monitored by security software. It acquires necessary call information from an untampered version of ntdll.dll and implements the Hell’s Gate technique, a method associated with indirect syscall evasion research. This approach aims to reduce visibility from user-mode hooks, allowing the malware to operate stealthily.

The malware also incorporates robust anti-analysis mechanisms. It actively scans for indicators of virtual machines, debuggers, user inactivity, low system resources, unusual usernames, and sandbox environments. If any “hard-fail” checks are triggered or if the detected environment scores too low on its “real-user” metric, 2CLoader terminates execution before decrypting its payload, preventing researchers from analyzing its full capabilities.

In certain iterations, 2CLoader can install inline trampoline hooks within Windows APIs after the payload has been decrypted. These hooks can manipulate various system attributes, including usernames, computer names, registry values, environment variables, volume serial numbers, and portions of IPv4 addresses found in network data. This deception aims to present misleading, yet structurally valid, system information to subsequent security checks.

For persistence, the loader can leverage several Windows mechanisms, such as the Run or RunOnce registry keys, the Startup folder, scheduled tasks, Windows Load settings, or logon scripts. It offers multiple payload execution methods, including running directly in memory, manual mapping into the current process, or replacing a suspended process image. This operational flexibility mirrors tactics observed in large-scale loader campaigns, designed to keep the final stealer hidden from file-based inspection.

Vidar and Remus Delivery Risk

Analysis of observed 2CLoader samples indicates a primary focus on delivering Vidar and Remus, both potent credential-stealing malware. Additionally, the presence of XWorm RAT expands the potential threat beyond data theft to include full remote control over compromised systems. A notable XWorm campaign, which used fake receipts as a lure, illustrates how multi-stage delivery through loaders can transform an innocuous-looking file into a gateway for extensive account compromise.

2CLoader establishes communication with its command-and-control (C2) infrastructure via HTTP. It transmits XOR-encrypted JSON messages containing registration and status details about the infected system. This includes operating system version, process ID, privilege level, processor count, memory specifications, locale, and the malware’s installation path, providing operators with a comprehensive inventory of compromised devices.

The loader’s configuration supports optional payloads and can even display a decoy message box to mislead users. One execution path allows it to spoof explorer.exe as the parent process for a new malicious process and elevate debugging privileges. Another common method targets dllhost.exe, suspending the legitimate process and redirecting it to execute the malicious payload. This adaptability enables 2CLoader to support diverse campaigns and accommodate various payload formats.

What You Should Do

• Implement robust, multi-layered endpoint and network security solutions capable of detecting advanced evasion techniques.
• Actively monitor for unusual HTTP POST requests, suspicious execution originating from temporary directories, unexpected scheduled tasks, and abnormal process relationships involving dllhost.exe or explorer.exe.
• Ensure all security defenses, including antivirus, EDR, and intrusion prevention systems, are kept up-to-date with the latest threat intelligence.
• Restrict the execution of untrusted software and enforce application whitelisting where feasible.
• Immediately block and hunt for the provided Indicators of Compromise (IoCs) across your network and endpoints.
• Conduct thorough forensic analysis on any potentially compromised systems to identify browser credential theft and unauthorized sessions.
• For affected users, reset all potentially compromised passwords, invalidate active sessions where possible, and enforce multi-factor authentication (MFA) across all accounts after initial incident triage.

Indicators of Compromise (IoCs)

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.