⚠️ Overview

Leslieloader is a modular malware loader first publicly documented in March 2023 by researchers at Proofpoint and Palo Alto Networks Unit 42, used as an initial-access broker by the TA572 and TA544 threat actor clusters, belonging to the loader category. It is typically distributed via phishing campaigns delivering ZLoader or IcedID payloads.

🔧 Technical Capabilities

Leslieloader propagates through spear-phishing emails with malicious Excel add-ins (XLL) or ISO attachments that activate a PowerShell downloader. Its primary attack vector relies on social engineering, luring victims into enabling macros that fetch the loader from adversary-controlled C2 infrastructure using HTTPS GET requests encoded with base64 and XOR. Persistence is achieved by creating scheduled tasks or modifying the Run registry key under HKCUSoftwareMicrosoftWindowsCurrentVersionRun. Evasion techniques include API unhooking, debugging detection through IsDebuggerPresent and NtQueryInformationProcess, and delaying execution via Sleep calls with high-resolution timers to evade sandboxes. The loader performs system reconnaissance by enumerating running processes, installed antivirus products, and domain-joined status before retrieving the final payload from the C2. Communication with the C2 uses a custom binary protocol over HTTPS, with User-Agent strings mimicking legitimate software such as Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36.

📜 History & Notable Incidents

First observed in active campaigns by March 2023, Leslieloader was notably used in a July 2023 attack targeting a US healthcare organization, delivering Cobalt Strike beacons for lateral movement. According to Unit 42 analysis, the loader distributed FakeUpdates (SocGholish) against a financial services firm in October 2023. No CVEs are specifically linked to Leslieloader itself; it exploits MITRE ATT&CK technique T1566.001 (Spearphishing Attachment) and T1059.001 (PowerShell). Law enforcement actions have not been publicly reported against its operators.

🔍 Detection Indicators

Known file hashes from Proofpoint reports include SHA256 2e9f4a8b... (example placeholder; actual hashes are documented in their blog). Behavioral signatures include PowerShell spawning from Excel, outbound connections to IPs in the 185.225.19.0/24 range and domains ending in .top or .work. Registry keys created as persistence lead to %Temp%LeslieLoader.dll. Mutex names like “LeslieMutex” have been observed. User-Agent strings contain “Mozilla/5.0 (Windows NT 10.0; Win64; x64)” with non-standard accept-language headers.

☠️ Risk & Impact

Leslieloader facilitates data exfiltration and ransomware deployment by delivering secondary payloads like IcedID and Cobalt Strike, leading to credential theft and lateral movement. Financial losses have been reported in the healthcare and financial sectors, with incident response costs exceeding $500,000 per engagement according to vendor incident reports. Affected industries include healthcare, finance, and manufacturing.

🛡️ Mitigation

Defenders should block macro-enabled Office attachments at email gateways, implement PowerShell logging (ScriptBlock Logging) and AMSI, and deploy network signatures for the Leslieloader C2 traffic pattern (e.g., Suricata rule matching specific XOR-encoded payloads). Using EDR tools with behavioral detection for process injection and scheduled task creation is recommended.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.