LausivLoader: The Malware That Defeats Fragmented Analysis

A malware sample detected in late August 2025 through a malspam campaign demonstrates an evasion technique that remains sparsely documented: passing data between infection stages via inherited environment variables, which renders every single fragment of the chain inert if analyzed in isolation. The technical analysis, published by the SANS Internet Storm Center on September 17, 2025, reconstructs the entire inter-process handoff mechanism and its practical implications for incident-response teams for the first time.

The Infection Chain: Five Stages, Two Invisible Handoffs

The infection begins with a .r01 attachment containing a 613 KB JavaScript file. According to the SANS ISC dossier, the code contains roughly 450 lines of comments composed of random English words serving as obfuscation; once the comments are stripped, the actual code shrinks to 205 KB. The script creates a directory in %TEMP% with a name generated from a random number and the current timestamp in base 36, then writes two files there with names ending in 'a' and 'b' respectively.

The technical point of interest occurs immediately after. The JavaScript sets two environment variables, Kv7408 and Kv562, with the full paths of the two temporary files. These variables are inherited by conhost.exe, which in turn passes them to PowerShell via the standard child-process inheritance mechanism. The source explicitly states: "child processes normally inherit their parent's environment." PowerShell then reads the paths from the environment variables, combines the contents of the two files, and initiates a decoding sequence.

The decoding uses AES-128-CBC with PKCS#7 padding, with a hardcoded key and initialization vector in the script. The result, decompressed via GZipStream, is a 64-bit .NET executable of 315,904 bytes. The executable is loaded into memory via reflection without ever being written to disk, eliminating a classic detection point for EDR solutions.

Why the Inherited Environment Is the Forensic Blind Spot

The choice to transfer data via environment variables rather than command-line arguments or directly readable files has a deliberate side effect: it makes static and per-partes analysis impractical. The SANS ISC analyst puts it precisely: "copying the decoded PowerShell command into an unrelated shell would not be able to recreate the original inputs, and per partes analysis of this infection chain would therefore not be practicable."

The problem is not in the PowerShell code itself, which appears harmless or incomprehensible on its own. The problem is the contextual dependency: the decoded command expects the environment to contain specific variables set by a predecessor that, in SOC logs, can appear as a completely separate and seemingly unrelated wscript.exe process. This temporal and spatial separation between writing the data and consuming it constitutes a methodological obstacle for anyone analyzing logs sequentially or isolating individual indicators of compromise.

The same source observes that "looking only at the decoded command would leave us with an incomplete picture." The operational consequence is that automated analysis systems that extract and deobfuscate the PowerShell script without reconstructing the process tree with its inherited environment variables will produce a technical false negative: the decoded code exists, but lacks its essential input.

From AMSI Bypass to PNG Steganography: The Subsequent Stages

After the in-memory load, the first .NET executable establishes persistence by copying itself to %LOCALAPPDATA%\Microsoft\PhotoEngine\PhotoStudio.js and creating a scheduled task named '\MicrosoftEdgeUpdateTaskCoreCore' with a logon trigger. The task runs wscript.exe with parameters //B //Nologo and the path of the copied script, masquerading execution as a legitimate system component update.

A second .NET loader resolves Windows APIs dynamically and patches AmsiScanBuffer and AmsiScanString to bypass the Antimalware Scan Interface. After evasion, it extracts every fifth byte from an embedded array of 299,520 bytes, reducing it to 59,904 bytes, then applies RC4 decryption. The result is a downloader that contacts the URL hxxps[:]//yapw[.]life/phpt/stego_zrgaixkku8.png.

"the loader would walk the PNG structure and look for an 'iTXt' chunk" — SANS Internet Storm Center

The downloader parses the PNG file structure and searches for the iTXt chunk with the initial marker 'FF 89 AD 4A'. The contained payload is decrypted with XOR and decompressed with DEFLATE; the analysis expects an 'MZ' header for native executables or a managed .NET assembly. Final execution occurs via reflection for .NET components or process hollowing for native executables. The URL was no longer active at the time of analysis; the final payload was not retrieved.

Why This Matters

The SANS ISC dossier does not document specific mitigations or detailed operational recommendations. The source does not specify the exact nature of data exposed during the infection, nor does it identify the malware family of the final payload. The analyzed sample dates to late August 2025; no more precise detection date emerges, nor details on the geography or language of the malspam, other than that it impersonated an employee of a legitimate company in the fiber-optics sector.

The brief does not list specific corporate entities, associated CVEs, or confirmations of current C2 infrastructure activity beyond the URL's offline status at the time of analysis. The researcher who conducted the analysis is not named in the source.

What the dossier documents clearly is the technical evolution: loaders are abandoning purely syntactic obfuscation in favor of techniques that exploit legitimate operating-system behaviors — in this case, environment-variable inheritance — and seemingly innocuous file formats like PNG with standard iTXt chunks. These approaches are inherently harder to detect than executables with fake extensions or scripts with recognizable obfuscation patterns.

The Challenge for Defenders: When Partial Logs Deceive

The inter-process handoff technique via environment variables raises a methodological question for SOCs. Analysis tools that extract and classify PowerShell commands in isolation, without reconstructing the environment state at execution time, risk classifying as benign or incomplete samples that are actually intermediate stages of an active chain. The environment variable is invisible in network logs and often truncated or omitted in endpoint logs unless explicitly configured for full capture.

The choice of the iTXt chunk inside a PNG, instead of more suspicious formats like executables with double extensions, indicates a preference for blending into legitimate data streams. iTXt chunks are part of the PNG standard and can contain textual metadata without altering image rendering; their use for executable payloads exploits the scant attention security tools pay to this type of container.

Questions and Answers

Why does static analysis of the PowerShell script fail in this case?

Because the decoded command depends on environment variables set by a previous process (JavaScript via wscript.exe). Without those variables, which contain the paths of the temporary files to be combined and decoded, the PowerShell script has no access to its inputs. Static analysis of the PowerShell code alone therefore produces an incomplete or non-functional command.

Is the environment-variable inheritance mechanism a vulnerability?

No. It is a standard, documented operating-system behavior. The source explicitly defines it as "just an ordinary environment inheritance used to pass information between different stages of an execution chain." The novelty lies in the tactical use of this behavior for malicious purposes, not in its nature.

What makes PNG steganography with iTXt chunks harder to detect?

The iTXt chunk is a legitimate PNG structure designed for international textual metadata. Unlike executable attachments or Office macros, a PNG with an iTXt chunk presents no format anomalies or standard security triggers. Analysis tools must implement specific PNG structure parsing to uncover payloads hidden in this location.

Sources

• https://isc.sans.edu/diary/rss/33348
• https://www.virustotal.com/gui/file/408b2df6e81824fa5bdf4f0fbd185a7e6db06e2be98fbeebce416f66954b9fa9

Information is based on the cited source and current as of publication.

Sources