LevelBlue Labs Discovers Highly Evasive, New Loader Targeting Chinese Organizations

Executive Summary

LevelBlue Labs recently discovered a new highly evasive loader that is being delivered to specific targets through phishing attachments. A loader is a type of malware used to load second-stage payload malware onto a victim’s system.  Due to the lack of previous samples observed in the wild, LevelBlue Labs has named this malware “SquidLoader,” given its clear efforts at decoy and evasion. After analysis of the sample LevelBlue Labs retrieved, we uncovered several techniques SquidLoader is using to …

attachments chinese evasive executive in the wild labs levelblue loader malware organizations payload phishing stage system targeting victim