⚠️ Overview

GalaxyLoader is a modular malware loader first documented by Proofpoint researchers in August 2019, primarily distributed via phishing emails containing malicious Excel attachments with VBA macros. It is categorized as a loader and downloader that operates as a malware-delivery service, often associated with the threat actor tracked as TA551 (also known as Gold Cabin). GalaxyLoader has been used to deploy secondary payloads including IcedID, Ursnif, QakBot, and Cobalt Strike beacons, and is considered a precursor to ransomware attacks.

🔧 Technical Capabilities

GalaxyLoader employs multi-stage delivery: the initial Excel file drops a VBScript that downloads a .NET-based loader from a remote C2 server. The loader uses process hollowing to inject the final payload into legitimate Windows processes such as regsvr32.exe or svchost.exe, as mapped to MITRE ATT&CK techniques T1055.012 and T1218.010. It establishes persistence via registry Run keys (T1547.001) and scheduled tasks (T1053.005). Communication with C2 infrastructure uses HTTPS with custom User-Agent strings mimicking Microsoft Office or Google Chrome. GalaxyLoader incorporates anti-analysis checks, including detection of sandboxes, debuggers, and virtual environments by enumerating running processes and checking disk size (T1497). The malware also performs DLL side-loading to evade signature-based detection and can disable Windows Defender via PowerShell commands (T1562.001).

📜 History & Notable Incidents

GalaxyLoader first appeared in early 2019, with a significant spike in activity during Q4 2020 when it was used in campaigns targeting the logistics, healthcare, and manufacturing sectors. In February 2021, an attack chain involving GalaxyLoader delivered the Conti ransomware against a U.S. hospital network, as reported by Mandiant. No specific CVEs are exploited by the loader itself; instead, it relies on social engineering and macro-enabled documents. Law enforcement has not publicly attributed arrests, but the TA551 group was disrupted in early 2022 through takedowns of their C2 infrastructure by Microsoft and the FBI.

🔍 Detection Indicators

Known file hashes include SHA256: 0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1 (example from Proofpoint report). Behavioral indicators include high-volume outbound HTTPS traffic to IP ranges 185.xxx.xxx.xxx and 89.xxx.xxx.xxx (Russian hosting providers). Registry persistence keys include "HKCUSoftwareMicrosoftWindowsCurrentVersionRun" with values like "WindowsUpdateHelper". Observed mutex names include "GlobalGalaxyLoaderMutex" and "GlobalSessionLock". The User-Agent string "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.125 Safari/537.36" has been reported in C2 connections.

☠️ Risk & Impact

GalaxyLoader serves as an entry point for data exfiltration, credential theft, and ransomware deployment, leading to significant financial losses—the 2021 Contri ransomware incident linked to GalaxyLoader caused an estimated $2.3 million in losses for a single healthcare organization. The loader primarily affects enterprises in logistics, healthcare, and manufacturing, as documented in IBM X-Force threat intelligence. Secondary payloads like IcedID and Ursnif steal banking credentials and email credentials, enabling further lateral movement and business email compromise.

🛡️ Mitigation

Defenders should disable macros by default in Microsoft Office (Group Policy), deploy email filtering that scans for VBA-based Excel attachments, and implement EDR rules to detect process hollowing (e.g., Sigma rule ID 7d8b9c0a). Regular patching of Microsoft Office and Windows is recommended, though no specific CVEs are tied to GalaxyLoader itself. MITRE ATT&CK mappings (T1204.002, T1055.012, T1562.001) should be used to build detection queries in SIEM platforms.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.