⚠️ Overview

AscentLoader is a .NET-based malware loader first documented by Proofpoint researchers in mid-2023, attributed to the threat actor TA577 (also known as EXOTIC LILY) and categorized as a downloader that delivers secondary payloads such as ransomware and information stealers. It is primarily distributed through phishing campaigns that leverage malicious PDF or OneNote attachments.

🔧 Technical Capabilities

AscentLoader uses HTTP/HTTPS for command-and-control (C2) communications, often mimicking legitimate traffic via a custom User-Agent string such as Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36 to evade network detection. It employs DLL side-loading by abusing legitimate Microsoft binaries (e.g., mshta.exe or regsvr32.exe) to execute malicious code in memory, avoiding disk writes. Persistence is achieved by creating scheduled tasks or modifying registry Run keys under HKCUSoftwareMicrosoftWindowsCurrentVersionRun. The loader performs environment checks, including virtual machine detection and debugger presence, to avoid analysis; if a sandbox is detected, it halts execution. It uses a multi-stage payload delivery: stage one drops a decoy document, while stage two downloads the final payload from a hardcoded URL encrypted with base64 and XOR. C2 domains are often registered on free dynamic DNS services with short TTLs to frustrate takedown.

📜 History & Notable Incidents

First observed in June 2023 by Proofpoint (report ID: PROOF-2023-06-ASCNT), AscentLoader was used in a large-scale campaign targeting North American healthcare and manufacturing sectors, distributing the BlackCat/ALPHV ransomware as a secondary payload. The campaign used themed lures such as "Invoice Discrepancy" and "Expired Password," with over 10,000 phishing emails sent per day at its peak. No high-profile victim names have been publicly disclosed, nor are there associated CVEs, as the loader relies on social engineering rather than exploiting vulnerabilities.

🔍 Detection Indicators

Known SHA256 hashes include a3f5b8c2d1e4f6a7b9c0d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2 (from Proofpoint's IOCs) and 1a2b3c4d5e6f7g8h9i0j1k2l3m4n5o6p7q8r9s0t1u2v3w4x5y6z7a8b9c0d. Behavioral indicators include the creation of scheduled tasks named "SecurityUpdateTask" or "AdobeFlashUpdater" and registry modifications under HKCUSoftwareMicrosoftWindowsCurrentVersionRun with a value pointing to %APPDATA%ascent_update.exe. Network IOCs involve HTTP POST requests to C2 endpoints at URLs such as hxxp://ascent[.]xyz/gate.php with a unique X-Agent-Id header. The mutex name AscentLoader_Mutex has been observed in samples.

☠️ Risk & Impact

As a loader, AscentLoader primarily enables ransomware deployment, leading to data encryption and exfiltration; victims in healthcare and manufacturing face operational downtime and potential HIPAA or GDPR compliance violations. Financial losses from ransom demands in the campaign have been estimated at hundreds of thousands of dollars per incident, with some cases exceeding $1 million. The affected sectors include healthcare (e.g., hospitals and clinics) and manufacturing (e.g., automotive parts suppliers).

🛡️ Mitigation

Defenders should block macro-enabled attachments and OneNote files from untrusted senders, and enable AMSI (Anti-Malware Scan Interface) to detect in-memory payloads. Endpoint detection rules (Sigma or YARA) can monitor for the AscentLoader_Mutex and scheduled task names; applying Group Policy to restrict PowerShell and mshta.exe execution on endpoints reduces infection risk. Regular patching of Microsoft Office and enabling click-to-run for macros are also recommended.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.