Loading malware…
TerraLoader is a Windows-focused malware loader in the Golden Chickens malware-as-a-service ecosystem, also associated with the threat actor tracked as Venom Spider. It is commonly used as an intermediate stage after VenomLNK or related social-engineering lures and is designed to instantiate and deliver follow-on Golden Chickens components, including more_eggs-related payloads and objective-based plugins. TerraLoader has been linked to operations conducted by financially motivated groups that have used Golden Chickens tooling, including FIN6, Cobalt Group, and Evilnum.
TerraLoader is typically implemented as a heavily obfuscated JavaScript-based loader and has also been observed in dropper and DLL-assisted forms. Its tradecraft emphasizes stealth, layered decoding, and living-off-the-land execution. Reported behaviors include abuse of legitimate Windows utilities such as WMI, regsvr32, ie4uinit, cmstp, msxsl, cscript, and typeperf to execute payloads, maintain persistence, and evade detection. Some variants reconstruct or drop auxiliary components and decoy documents, while others execute later stages largely in memory. Persistence has been observed through user logon script mechanisms, and some samples include scheduled-task artifacts.
The loader supports delivery of modular post-compromise tooling used for credential theft, lateral movement, remote access, and ransomware enablement. It has been described as capable of loading plugins such as TerraStealer, TerraPreter, TerraTV, TerraCrypt, and more_eggs backdoors. In broader intrusion chains, TerraLoader has served as a staging mechanism for hands-on-keyboard post-exploitation frameworks and additional malware families.
TerraLoader also incorporates anti-analysis and victim-validation logic. Observed variants perform sandbox or environment checks using hardware, file, computer-name, processor, network, or account attributes, and some use victim-specific keying material to decrypt final payloads only on intended hosts. Additional anti-debugging and delay mechanisms have been reported, including exception-based logic and decryption routines that double as timing controls. These characteristics indicate selective targeting and an effort to frustrate automated analysis.
Delivery has most often been associated with targeted phishing and spearphishing campaigns using fake job offers, resumes, or employment-themed lures, frequently packaged in archives containing malicious shortcut files or related script-based stages. Victims have included hiring managers, recruiters, and organizations in sectors such as finance, e-commerce, healthcare technology, aerospace and defense, legal, accounting, staffing, and other corporate environments.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
By abusing Windows Management Instrumentation, VenomLNK enables the malware’s plugin loader, TerraLoader, which then hijacks legitimate Windows processes, cmstp and regsvr32.
Terraloader : Congrats, you have a new fake job ! ... This drops TerraStealer and the lure for a fake employement.
The malware author responsible for the TerraLoader... appears to have been happily updating their delivery system again referred to as TerraLoader.
"B. TerraLoader Advanced malware loader designed to deliver custom payloads. Can execute fileless attacks... including DLL sideloading."
26 distinct techniques documented for this family, organized by ATT&CK tactic.
Execution using WMI [T1047] Commands and other processes can also be executed using Windows Management Instrumentation (WMI) infrastructure.
Partial strings for reference: ... schtasks.exe /Create /TN UserInitMprLogonScript ... Also a part of the XML for task scheduling
What is out of the question, however, is the sophistication of this technology including an integrated methodology of loading such frameworks Metasploit, Cobalt Strike, TerraLoader, and PowerShell Empire to perform further victim post-exploitation.
What is out of the question, however, is the sophistication of this technology including an integrated methodology of loading such frameworks Metasploit, Cobalt Strike, TerraLoader, and PowerShell Empire to perform further victim post-exploitation.
C:\Windows\system32\cmd.exe /c del " C:\Users\admin\AppData\Local\Temp\58611.ocx " >> NUL
the dropper DLL portion has always utilized a simple XOR based routine for bruting out its own string encoding key while also leveraging various secondary routines to use the key once found(XOR, AES, RC4). The author has moved to using RC4 for bruting out the string encoding key
a decoy word document is presented to the victim. The document is designed to impersonate a legitimate employment application
more_eggs maintains a stealthy profile by abusing legitimate Windows processes
cmd.exe /c del " C:\Users\admin\AppData\Local\Temp\58611.ocx " >> NUL
the malware is basically designed to build out the more_eggs backdoor for dropping to disk and detonating.
TerraLoader, which then hijacks legitimate Windows processes, cmstp and regsvr32.
Msxsl.exe execution [T1220] In another effort to maintain persistence on the host, the script would leverage the msxsl.exe LOLbin to re-run this particular script file and then sleep.
the dropper appears to be checking if the computer name is FLAREVM... this check function does happen before the backdoor is decoded
Evilnum has used a component called TerraLoader to check certain hardware and file information to detect sandboxed environments.
References MITRE ATT&CK Matrix Enterprise tactics Technics used Ref URL Discovery Query Registry
Compared to the "Killswitch" version that check the processor or/and network card or/and user account for identifier for see if it's the good victim.
this new backdoor is actually dropped by being encoded with the addition of computer based information added to the key... showing the ‘PROCESSOR_IDENTIFIER’ and ‘COMPUTERNAME’ along with ‘.ComputerName +’
the dropper appears to be checking if the computer name is FLAREVM... this check function does happen before the backdoor is decoded
Evilnum has used a component called TerraLoader to check certain hardware and file information to detect sandboxed environments.
8 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A heavily obfuscated JavaScript loader/backdoor in the More_eggs infection chain that establishes C2, stages files in %APPDATA%\Microsoft\, executes commands, uses WMI and msxsl.exe, and maintains persistence.
"...their current limitations indicate immaturity compared to established tools like TerraLoader or VenomLNK."
Payload loader used to deliver custom secondary malware; supports fileless execution and stealth techniques such as DLL sideloading to reduce AV detection.
Loader tool attributed to Golden Chickens (no additional functional details provided in the content).
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.