Reflective Loader

A reflective loader is a type of malware that can load a Dynamic Link Library (DLL) into a process, often without the user's knowledge. This technique allows the malware to execute malicious code directly from memory, making it harder for antivirus software to detect and remove it. The loader operates by prepending itself to a DLL, then loading the DLL into virtual memory. This method has been used in various forms of malware, including Cobalt Strike, where it loads the beacon DLL into virtual memory. The reflective loader enables the execution of the Core-Implant in an updated variant, employing new obfuscation techniques such as different file names and registry keys. The reflective loader has evolved over time, with the ability to resolve and pass system call information to Beacon, overriding Beacon’s default system call resolver. This evolution also includes the ability to export the Beacon payload without a reflective loader, which supports prepend-style User Defined Reflective Loaders (UDRLs), allowing for more versatile deployment and execution of the Beacon payload in various environments. Other advancements include support for callbacks in a number of built-in functions, a new in-Beacon data store, and more. The reflective loader has also been utilized in executing LunarWeb and LunarMail, and when the badger is injected, its reflective loader instantly loads all dependencies required for the badger. However, the use of reflective loaders is not without its challenges. For instance, during lateral movement phases, attackers have been found to drop custom loaders in unique locations on each system. Most Beacon and Reflective Loader instances discovered during investigations were configured with unique identifiers such as C2 domain name, Watermark ID, PE compile timestamp, DNS Idle IP, User-Agent, and HTTP POST/GET transaction URI. At the conclusion of the de-obfuscation process, both variants proceed to load the Reflective Loader in memory, which subsequently executes Cobalt Strike Beacon in memory. Type A loaders use a simple rolling XOR methodology to decode the Reflective Loader, while Type B loaders (Raindrop) utilize a combination of AES-256 encryption algorithm, LZMA compression, and a single-byte XOR decoding routine to de-obfuscate the embedded Reflective Loader in memory. The ultimate goal of both Type A and B loaders is to de-obfuscate and load a Cobalt Strike Reflective Loader in memory.