OXLOADER → CastleStealer — Node.js Malvertising Loader (REF8372)

OXLOADER (Elastic Security Labs campaign REF8372) is a previously-unreported Windows loader distributed through malicious Google Ads that impersonate the Node.js installer. Victims in the US searching for legitimate Node.js are redirected to a lookalike landing page, download a batch package (BATPackageBuilderSetup.bat) that renders a fake install wizard, and silently fetch a Storj-hosted next-stage executable. That executable — OXLOADER — elevates via a Start-Process -Verb RunAs UAC prompt, runs an array of anti-analysis checks, then reflectively loads CastleStealer, a .NET information stealer that harvests browser, wallet, and credential data.

The loader is built for stealth: control-flow flattening, opaque predicates, mixed Boolean-Arithmetic (MBA) obfuscation, self-modifying decryption stubs, abuse of the PE .reloc section to stage shellcode, a DonutLoader wrapper for in-memory .NET execution, and Chaskey-LTS payload encryption. The actor is assessed Russian-speaking and financially motivated — it explicitly skips machines in the CIS region and with Russian locale (LANGID 0x419).

The best defensive angle is the delivery seam: a fake-installer batch script spawning powershell.exe that downloads from link.storjshare.io and re-launches a freshly-dropped EXE with -Verb RunAs. That process lineage is rare in benign software installs and gives a high-fidelity, low-FP catch before the stealer ever runs.

Defender priority: Hunt for powershell.exe downloading from *.storjshare.io and any process re-launching a just-written EXE with -Verb RunAs. Block the published C2 IPs (89.124.95.161, 89.124.115.82) and the malvertising domains, and load the OXLOADER/CastleStealer hashes as prevent IOCs.

Atomic IOCs in this pack (hashes, domains, C2 IPs) are carried directly from the Elastic Security Labs appendix. No IOC here is inferred or fabricated — see §18 References for source mapping.

Hunt Hypotheses (fidelity-ordered)

1. H1 (high): A fake-installer batch/PowerShell chain downloads a payload from *.storjshare.io — visible in ProcessRollup2 command lines. Very low FP.
2. H2 (high): A process re-launches a freshly-dropped EXE with Start-Process -Verb RunAs to force a UAC elevation — rare outside installers.
3. H3 (high): Known OXLOADER / CastleStealer SHA256 hashes execute or are written to disk.
4. H4 (high): Beacon to CastleStealer C2 IPs 89.124.95.161 / 89.124.115.82.
5. H5 (medium): DNS / connection to the malvertising landing + redirector domains (prentiva99.info, miloyannopoulos.com).
6. H6 (medium): DLL side-loading — dui70.dll copied to a random .ocx and loaded from a user-writable path.
7. H7 (medium): Binaries masquerading as node-v*-x64-86.exe / apimonitor-x64.exe launched from a browser download directory.

Attack Chain

• Secure web gateway / proxy: Block and alert on any download from *.storjshare.io by an interactive browser session, and on the malvertising domains. Storj raw-object hosting is rare in enterprise traffic.
• Google Ads / DNS: Hunt newly-registered lookalike domains containing node/nodejs resolved shortly before a binary download.
• Windows Sysmon (if deployed): Event ID 1 — powershell.exe with -Verb RunAs and a URL in the command line; Event ID 7 — module load of a .ocx from a user profile path.
• EDR quarantine review: Cross-check any blocked node-v*-x64-86.exe or apimonitor-x64.exe detection against the hash list in §4.

Q1 and Q7 are strong Custom IOA promotion candidates. Q2 should run as Investigate-only until the deployment-agent exclusions are validated in-tenant.

1 · Enable PowerShell script-block + module logging (GPO/registry)

REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1 /f
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging" /v EnableModuleLogging /t REG_DWORD /d 1 /f
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging\ModuleNames" /v "*" /t REG_SZ /d "*" /f

2 · Block executable content from web (ASR, Defender)

Add-MpPreference -AttackSurfaceReductionRules_Ids 3B576869-A4EC-4529-8536-B80A7769E899 -AttackSurfaceReductionRules_Actions Enabled
Add-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled

3 · Hunt residual fake installers on disk

Get-ChildItem "$env:USERPROFILE\Downloads","$env:TEMP" -Recurse -Include *.bat,*.exe -ErrorAction SilentlyContinue |
  Where-Object { $_.Name -match 'node-v.*-x64-86|apimonitor-x64|BATPackage' } |
  Select-Object FullName,Length,LastWriteTime

Test ASR rules in audit mode (-AttackSurfaceReductionRules_Actions AuditMode) on a pilot ring before enforcing.

Two gaps remain: in-memory sandbox-evasion logic (T1497.001) and CastleStealer's local credential/wallet read (T1555) are not directly observable in standard Falcon process telemetry — rely on the hash/C2/behavioral catches upstream and downstream of those steps. Validation gates (§11) must pass before promoting Q1/Q7 to Custom IOAs.