CastleLoader is a loader malware that first emerged in early 2025. Since its emergence, CastleLoader has been distributing various information stealers and remote access trojans (RATs) through Cloudflare-themed Clickfix phishing attacks and fake Github repositories opened under the names of legitimate applications.
The report on the campaigns is available here.
The loader analysis is available here.
85.158.108.135
107.158.128.45
185.219.220.128
185.212.47.84
94.159.113.123
173.44.141.89
80.77.23.48
vilaoaza.com
lekuvam.com
cisco-webexxapp.xyz
polarcompany.org
mhousecreative.com
https://github.com/ssms-lib/ssms
https://github.com/zscaler‑dir/Zscaler‑Client‑Connector
vanservernode.pro
multiport.shop
eightroutes.shop
basishost.pro
bytehub.asia
docusign.sa.com
oktacheck.it.com
buzzedcompany.com
loyalcompany.net
teamsapi.net
| SHA256 |
|---|
| 05ecf871c7382b0c74e5bac267bb5d12446f52368bb1bfe5d2a4200d0f43c1d8 |
| SHA256 |
|---|
| f7061b2c4d8759f5d76a48b8f1512154e1fc4e4feeaa69274e63ebd0443d45e9 |
| 1e48de11acad995d579f377d681f10bf451975f76030cbf0df8bc19ccbcb3f28 |
| 343517d92b5ad4c066b8fba11e08e23c1a6485c90e5278894a5b27791fdb17b8 |
| 29cadbd2a03fbbe40a17b428e639f2e66d5b0561afb2a497ac5c8a49b441b349 |
| 1b7394ac4561af3cff242b32845b7f2e4194cc2abd59bed30de8ad259b367dcb |
| dd314bf3c9c209d536a7a210fdbfb66befa4aa7e3ba31b40106affef76523103 |
| 0047d442770a7fcaecea6e6f78bfb90be3dbc92bc36fc7045eb1bb30a3a7fd16 |
| bb42d5828af233ebec31e0b233b3614b1c189185805ecd5a4469629ca08337ed |
| 5cf309d5466d51c6780476f9d255f2326150b15abee010dd653d14dbaf9d0611 |
| 1fe2c7cdca3bc18474424f6f094572aaca6786759aaf903da22caf806792feff |
| 6257d2af8bac1c4e4035b5bddc65bb84cc7973e9dbd772eb20170b91dbe8067b |
| 340d84a0bfd03dc58dcfe7c06f655df2a99285627fb36e209c5fadc1710ff0f9 |
| 0905bef14234ee6c7b6ab978095d8f8572f94d78418855f52834ee65ce4c2018 |
| 2338465dea713652c4a7bb5d9dbbb97c1ce492cd30390500e9d2e4887ed184a3 |
| 86988ef162aa548b42c74b3a6e16f12004372baa2b89347e43d4ac089bf885c9 |
| b87a47a89a70a91d83350128c5815f42f3c609504882f8e69fa2d72d6db7fe58 |
| 27fb6e021482b68d98683b737a53dc4ac39da86e92cc764ea25f79de5ea25096 |
| da6b3964053567a25cfc0ea18cd6827e4124d9b86775e84945b4a17a19f2bd07 |
| 87eb00b232719f0cf6d212f6c4a0ae9bd45e73f05a311e2b61e7eedd8d5cc9d5 |
| e1e0ae2b2b6dfc7dd1e38c6266f932a2db0fd675d07ed5bc76f3a40e7b0cc75b |
| 428eee7f68f80671bf80116d8d25c30ab9af9dd57e8418b1b28e694d1a04c937 |
| 610bc49f1fecfdc758884e67498708a3c0bd370ecea05eaf27ff1fe560795fb2 |
| 927fb052f83a49134b9cd436dea7ddfd9d5ca716ef84a5be891c452f756017b6 |
| f86872cea305ad66a45476beb77d3d37b23207eafb735ad8b53f61d4705f1536 |
| 5514a7f4f79dc0a43351f3ae24ca6a7fe813e1655863963ddf06b4fdbd026f4d |
| 482555fe47e5e282c463559ecbbb3267618697fedf12968ccf5094e62c9cc40d |
| d6606cb1b6e0932538463af572413ef93b485ff3b7c5373ae09dd17d8d6ed342 |
| 96c4ce4c168edb12b690c029b04351a6e1b579dcab6b3e11b86145c32a4f197d |
| d97aafc59cce31ce2cd7fe1f4d36656a67c3ce00091c51b91ab23e285b3c9043 |
| 932adc53ec6f24c029c62712abb311b27f0f6264fdd4e398f62fb79da6e8246f |
| 940ad9d4a0157016ff9299567cbc410ed0d7679ebc80cb359d84ceda889974ed |
| 9dca5241822a0e954484d6c303475f94978b6ef0a016cbae1fba29d0aed86288 |
| 58e534f2f613c6aaf47bfe2339a1e16fa5cf79d72fa29a5d8765418c69a9d324 |
| b4348e205f8019d7872ea5f93d4996031c9a965b790df41d7ba14bcfee40ff8e |
| e7c7bb3d4d08843908ab62590342ce978fabcde2106d90195dd2a33dc378823d |
| 2e6674956922ee6780d9f03260fd4a91f0ccc709ecb1b264e14bd0491e9ddd94 |
| 0fdc2b9cbb49e3a5974df1856ddd5ad7c6ad470f313f2251b0bafcfc17050c06 |
| 2286a8940aeea9f05c7ad2189e962dff55b3bcd15f4bdd763ac8ae87add15542 |
| 9c58f7270314303c8c17a925ef1098b3a60d06b5f5b41b5459a2f62c50e903fc |
| 458f14b10868943af96dc213467c14ca61e6ed6906f36b87a9235f01213789a3 |
| 23bea7c8a2aeecf05fefce9ac731d6f99ccb0637720918f44a7e299cc4bbaee2 |
| 01be5ffda2257441a981d5491b6943bce154bce706af995135f90826ec451459 |
| f4bdea09e45471612689bd7d76aa5492fb9de69582d3cf5082d585c16e340d4c |
| ef64df6db475812a91bc6d58f0cf5444c69ee2b7eb4b8691377f7104a8b1e449 |
| 05ecf871c7382b0c74e5bac267bb5d12446f52368bb1bfe5d2a4200d0f43c1d8 |
| e16b5eda7e6eecad858faa89cabb3fd5f6b108b70f2fa18eb38fbbe3d679dd3d |
| bf21161c808ae74bf08e8d7f83334ba926ffa0bab96ccac42dde418270387890 |
| 437a6f5e7d09863c952f904a28fcc3465dcdb39707418df6ee7dc0e4f9961da6 |