# LausivLoader multi-stage JavaScript loader analysis

Published: 2026-09-17 · Severity: routine
Canonical: https://vorant.io/reports/784c53cd-3ca1-54c8-9237-216f5d9d13dc/lausivloader-multi-stage-javascript-loader-analysis

> Multi-stage JavaScript malware uses environment variables to pass data between stages, eventually downloading encrypted payload from PNG steganography.

LausivLoader is a multi-stage malware loader delivered via spearphishing emails with purchase-quotation lures containing RAR archives with obfuscated JavaScript files. The attack chain begins with a JavaScript file that copies itself for persistence via scheduled task masquerading as MicrosoftEdgeUpdateTaskCore, creates temporary files in %TEMP%, and uses process environment variables (Kv7408, Kv562) to pass file paths to a PowerShell stage. The PowerShell stage reads two temporary files, combines and decrypts their contents using AES-128-CBC, decompresses with GZip, and loads the result as a .NET assembly in memory without writing to disk. The first .NET loader (315,904 bytes) attempts to patch AMSI and loads a second .NET executable (59,904 bytes) that downloads a PNG file from a remote server. The final stage extracts payload from PNG iTXt metadata chunks using XOR decryption and DEFLATE decompression, then executes the recovered PE via either .NET reflection (if managed assembly) or process hollowing (if native executable). The URL was not live at analysis time. The malware uses multiple obfuscation techniques including Base64 encoding, AES encryption, RC4 encryption, GZip/DEFLATE compression, junk code insertion, and embedded padding removal.

## Mentioned in this report

- Malware: LausivLoader

## Detection guidance (public sample)

### Script Host Executing JavaScript From WinRAR Temporary Extraction Directory

ATT&CK: T1204.002

Detects wscript.exe or cscript.exe launching a .js/.jse file straight from a WinRAR temp extraction folder (Rar$...). This matches the spearphishing lure where a RAR attachment holds an obfuscated JavaScript loader that the victim opens directly. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Script Host Executing JavaScript From WinRAR Temporary Extraction Directory
description: Detects wscript.exe or cscript.exe launching a .js/.jse file directly
  from a WinRAR temporary extraction folder (Rar$). Matches a RAR attachment containing
  a JavaScript loader opened by the user, as in multi-stage JS loader phishing chains.
tags:
- attack.execution
- attack.t1204.002
- attack.t1059.007
- attack.t1566.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
    - \wscript.exe
    - \cscript.exe
  selection_path:
    CommandLine|contains: \Rar$
  selection_ext:
    CommandLine|contains:
    - .js
    - .jse
  condition: selection_img and selection_path and selection_ext
falsepositives:
- Users legitimately opening administrative JavaScript files directly from a RAR archive
- Developers testing Windows Script Host scripts shipped in archives
level: high
id: 81d88fde-4991-5d31-8f5d-ae8624a07e65
status: experimental
author: Vorant
references:
- https://isc.sans.edu/diary/rss/33348
```

### Scheduled Task Masquerading As Edge Update Running Script Host or JavaScript

ATT&CK: T1053.005

Detects schtasks.exe creating a task named like MicrosoftEdgeUpdateTask whose action is wscript/cscript or a .js file, imitating the Edge updater for persistence of a self-copied JavaScript loader. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Scheduled Task Masquerading As Edge Update Running Script Host or JavaScript
description: Detects schtasks.exe creating a task whose name imitates the Microsoft
  Edge updater (MicrosoftEdgeUpdateTask*) while its action is a Windows Script Host
  binary or a JavaScript file. The genuine Edge updater tasks do not run scripts through
  wscript/cscript.
tags:
- attack.persistence
- attack.stealth
- attack.t1053.005
- attack.t1036.004
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith: \schtasks.exe
    CommandLine|contains: /create
  selection_name:
    CommandLine|contains: MicrosoftEdgeUpdateTask
  selection_action:
    CommandLine|contains:
    - wscript
    - cscript
    - .js
    - .jse
  condition: selection_img and selection_name and selection_action
falsepositives:
- Custom enterprise scripts that deliberately reuse Edge update task naming (very
  rare)
level: high
id: d73b0b65-5723-51b3-bc95-593367384a8b
status: experimental
author: Vorant
references:
- https://isc.sans.edu/diary/rss/33348
```

### Script Host Spawning Hidden or Encoded PowerShell Stage

ATT&CK: T1059.001

Detects wscript.exe or cscript.exe spawning powershell.exe with hidden-window, encoded-command or in-memory .NET assembly loading indicators, as seen when a JavaScript loader hands off to a PowerShell decrypt/decompress/reflective-load stage. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Script Host Spawning Hidden or Encoded PowerShell Stage
description: Detects wscript.exe or cscript.exe spawning powershell.exe with hidden
  window, encoded command, or Base64/in-memory .NET assembly loading indicators. Typical
  of a JavaScript loader handing off to a PowerShell stage that decrypts and reflectively
  loads a .NET assembly.
tags:
- attack.execution
- attack.t1059.001
- attack.t1059.007
- attack.t1564.003
- attack.t1620
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \wscript.exe
    - \cscript.exe
  selection_child:
    Image|endswith:
    - \powershell.exe
    - \pwsh.exe
  selection_cli:
    CommandLine|contains:
    - hidden
    - -enc
    - FromBase64String
    - Reflection.Assembly
    - GZipStream
  condition: selection_parent and selection_child and selection_cli
falsepositives:
- Legacy IT logon scripts in VBScript/JScript that launch PowerShell hidden for administrative
  tasks
- Software installers using wscript to start hidden PowerShell configuration steps
level: medium
id: e31424be-1126-51b4-8819-51f5db9285f1
status: experimental
author: Vorant
references:
- https://isc.sans.edu/diary/rss/33348
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

2 more detections for this report are in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://isc.sans.edu/diary/rss/33348

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/784c53cd-3ca1-54c8-9237-216f5d9d13dc/lausivloader-multi-stage-javascript-loader-analysis.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup