CoffeeLoader Evades Detection with Advanced GPU-Based Techniques

TL;DR

CoffeeLoader, a sophisticated malware, employs advanced techniques such as GPU-based packing and call stack spoofing to evade detection. Distributed via SmokeLoader, it downloads second-stage payloads and uses Windows fibers to complicate analysis.

CoffeeLoader: A Stealthy Malware Threat

CoffeeLoader, a malware identified by Zscaler ThreatLabz, utilizes multiple advanced techniques to bypass endpoint security solutions and deliver second-stage payloads. Active since September 2024, this malware employs strategies like GPU-based packing, call stack spoofing, sleep obfuscation, and Windows fibers to avoid detection.

Advanced Evasion Techniques

CoffeeLoader incorporates several features to defeat security software:

• GPU-Based Packing: The malware uses a packer, named Armoury, that executes code on the GPU, making it difficult to analyze in virtual environments.
• Call Stack Spoofing: Masks function call origins to evade security tools that analyze stack traces.
• Sleep Obfuscation: Encrypts memory while inactive and decrypts during execution.
• Windows Fibers: Leverages fibers to manage multiple execution points within a single thread, further complicating detection.

Distribution and Similarities to SmokeLoader

CoffeeLoader is distributed through SmokeLoader, with which it shares several behavioral similarities. Both malware families use a stager to inject a main module into another process, generate a bot ID based on system details, and create a mutex name linked to the bot ID. They also resolve imports using hashing, store internal variables in a global structure, and encrypt network traffic with hardcoded RC4 keys.

Installation and Persistence

The CoffeeLoader dropper executes an installation routine with multiple variants:

• Non-Persistent Variant: Copies the packed DLL to the user’s temp directory and executes it via rundll32.exe.
• Persistent Variant: Copies the DLL to %PROGRAMDATA% or %LOCALAPPDATA%, sets restrictive file permissions, and schedules a task to run every 10 minutes.

Malware Commands and Detection Evasion

CoffeeLoader supports several commands to inject and execute shellcode, executables, and DLLs:

• Sleeping (0x58)
• Injecting Shellcode (0x87)
• Updating Sleep Obfuscation (0x89)
• Running Executable Payloads (0x91)
• Executing DLL Payloads (0x93)

The malware also uses call stack spoofing and Windows fibers to evade detection by antivirus and EDR solutions.

Conclusion

CoffeeLoader represents a significant threat in the malware landscape, employing innovative techniques to evade detection. Its similarities to SmokeLoader suggest a possible connection, although the exact relationship remains unclear. Security professionals must stay vigilant against such advanced threats to protect against potential cyber attacks.

Additional Resources

For further insights, check:

• Zscaler ThreatLabz Report on CoffeeLoader
• SmokeLoader Delivers Laplas Clipper
• Rhadamanthys Info-Stealer

References