2CLoader (Malware): news timeline & CVEs

New 2CLoader Malware Evades Security Tools to Deploy Vidar and Remus Stealers

Zscaler found 2CLoader, a Windows loader delivering Vidar, Remus, and XWorm while evading analysis.

Zscaler identified 2CLoader, a Windows malware loader first seen in August 2026 that primarily delivers the Vidar and Remus information stealers and has also deployed XWorm RAT. It stores an encrypted configuration and payload in an executable resource, uses indirect syscalls and anti-analysis checks, and can persist or run payloads in memory, including by replacing a suspended process. Stolen browser credentials and sessions could enable later account abuse. Zscaler published sample hashes and advised hunting unusual HTTP posts, scheduled tasks, and odd dllhost.exe or explorer.exe process relationships.

Cyber Security NewsOct 1, 08:13 UTC · 1d agoMalware in the wild 3 sources

New 2CLoader Malware Uses Anti-VM and API Hooking to Deliver Vidar and Remus Stealers

Zscaler details 2CLoader, a Windows loader using anti-VM checks and API hooks to deploy Vidar and Remus.

Zscaler ThreatLabz analyzed 2CLoader, a Windows loader that XOR-decrypts strings, uses Hell’s Gate indirect syscalls, and exits on anti-VM or debugger checks before decrypting an AES-GCM payload. It can hook Windows APIs, spoof host-identification data, and run payloads in memory through CLR hosting, manual PE mapping, or RunPE-style hollowing into dllhost.exe. Persistence includes Registry Run and RunOnce keys, the Startup folder, scheduled tasks, and logon scripts, with HTTP POST command-and-control. Observed payloads include Vidar, Remcos-family Remus, and XWorm; ThreatLabz released a Python decryptor and listed C2 aware-cr1[.]com plus an in-the-wild URL.

GBHackersupdated Oct 1, 08:13 UTC · 1d agofirst Oct 1, 05:03 UTC · 1d agoMalware in the wild 3 sources2

2CLoader: A New Malware Loader Delivering Vidar and Remus

Zscaler details 2CLoader, a new malware loader that delivers the Vidar and Remus payloads.

Zscaler ThreatLabz analyzed 2CLoader, a newly documented malware loader that delivers the Vidar infostealer and Remus. The loader keeps its configuration and encrypted payload in a portable-executable resource and decrypts them at runtime before optional decompression. It uses indirect system calls to bypass common API hooks, can inject the final payload into a selected executable, and supports scheduled-task persistence plus optional anti-analysis checks.

Zscaler ThreatLabzupdated Oct 1, 08:13 UTC · 1d agofirst Sep 30, 14:28 UTC · 2d agoMalware 3 sources

2CLoader

Timeline3 articles

Appears with

New 2CLoader Malware Evades Security Tools to Deploy Vidar and Remus Stealers

New 2CLoader Malware Uses Anti-VM and API Hooking to Deliver Vidar and Remus Stealers

2CLoader: A New Malware Loader Delivering Vidar and Remus