ThreatLabz has discovered a new Windows malware loader called 2CLoader, which has been used to deliver the Vidar and Remus information stealers, as well as the XWorm remote-access Trojan. Researchers observed the loader in August 2026 and found that it combines encrypted payloads, anti-analysis checks, indirect system calls, and Windows API hooks to evade security tools. The configuration is located in the final 0xDC bytes of the resource, encompassing execution flags, encryption details, persistence settings, sleep intervals, and target process names.

The loader employs Hell’s Gate-style indirect system calls for several critical Windows functions, including NtProtectVirtualMemory, NtUnmapViewOfSection, NtQueryInformationProcess, NtDelayExecution, NtSetContextThread, and NtGetContextThread. It maps a pristine copy of ntdll.dll from disk, extracts system-call numbers, and searches executable sections for syscall; ret instruction sequences.

The malware conducts anti-virtualization and anti-debugging checks, examining hypervisor data, running processes, loaded modules, registry keys, MAC addresses, system resources, screen resolution, user activity, and system uptime. These hooks can alter network data and replace system details such as usernames, computer names, volume serial numbers, registry values, and environment variables with randomly generated values, as reported by Zscaler. Indicators of Compromise IOC Type Indicator Description 2CLoader sample 2CLoader sample Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort.