Researchers of ESET, a global leader in the cybersecurity market, have discovered a unique and previously undocumented loader for Windows binaries.
Unlike other loaders of this type, it works as a server and executes the received modules in memory. A loader is malicious code (a program) used to load the object files of another executable onto the infected machine, in this case directly into memory. ESET has detected only a few samples of Wslink through its telemetry over the past two years, with detections in Central Europe, North America and the Middle East.
“Wslink is a simple but remarkable loader that, unlike the ones we usually see, operates as a server and executes the forms received in memory,” he explains Vladislav Hrčka, ESET researcher who discovered Wslink. “We named this new malware Wslink after one of its DLLs,” he adds.
There is no code, functionality or operational similarities that suggest this is a tool of a known cyber criminal group. Furthermore, its modules reuse loader functions for transmission, keys, and sockets; therefore they do not require the initiation of new outgoing connections. Wslink also features a well-developed cryptographic protocol to protect the data exchanged.
"We have implemented our own version of a Wslink client, which could be interesting for those approaching malware analysis, since it shows how to interact with the loader's output functions. Our analysis also serves as an information resource documenting this threat for information security managers," says Hrčka. The complete source code for the client is available in our GitHub repository WslinkClient.
More technical details on Wslink, in the blogpost “Wslink: Unique and undocumented malicious loader that, remarkably, runs as a server” su WeLiveSecurity.
