Executive Summary
LausivLoader is a sophisticated multi-stage malware family recently observed in malspam campaigns masquerading as supply chain requirements. The attack begins with a JavaScript file that employs heavy obfuscation and junk code to evade initial detection. A notable technical feature is its use of process environment variable inheritance to pass file paths to subsequent PowerShell stages, a technique that complicates sandbox analysis and manual command-line reconstruction.
The technical chain progresses from JavaScript to PowerShell, which decrypts and reflectively loads a .NET assembly. This assembly further attempts to bypass the Antimalware Scan Interface (AMSI) before downloading a final stage hidden within the metadata of a PNG file using steganography. Depending on the payload type, LausivLoader executes the final threat via either .NET reflection or process hollowing.
While the specific final payload was not identified in this report, the loader's use of legitimate system components like conhost.exe and scheduled tasks for persistence poses a significant risk to enterprise environments. Its ability to dynamically resolve APIs and modify memory buffers (AMSI/ETW) demonstrates a high level of technical proficiency aimed at bypassing modern endpoint protection solutions.