Elastic Security Labs has uncovered OXLOADER, a previously undocumented Windows malware loader distributed via malicious Google Ads impersonating Node.js. The loader delivers the CASTLESTEALER infostealer and achieves low detection rates through multiple obfuscation layers (control-flow flattening, mixed Boolean-Arithmetic, opaque predicates), self-modifying decryption stubs, and an unusual technique of staging shellcode inside the PE .reloc section via a copied .ocx file. Anti-sandbox checks include CPU count (≥3), RAM (≥3 GB), display refresh rate (≥20 Hz), and geographic/language exclusions targeting CIS regions and Russian-language systems, suggesting a financially motivated Russian-speaking threat actor. The final payload is delivered in-memory via DonutLoader wrapping the CASTLESTEALER .NET assembly. YARA rules and behavioral detection signatures are provided.
