{"id":10067,"date":"2024-11-27T11:09:20","date_gmt":"2024-11-27T11:09:20","guid":{"rendered":"\/cybersecurity-blog\/?p=10067"},"modified":"2025-07-17T11:00:59","modified_gmt":"2025-07-17T11:00:59","slug":"psloramyra-malware-technical-analysis","status":"publish","type":"post","link":"https:\/\/any.run\/cybersecurity-blog\/psloramyra-malware-technical-analysis\/","title":{"rendered":"PSLoramyra: Technical Analysis of Fileless Malware Loader"},"content":{"rendered":"\n

In this article, ANY.RUN<\/a>‘s analyst team will explore a malicious loader known as PSLoramyra<\/strong>. This advanced malware leverages PowerShell, VBS, and BAT scripts to inject malicious payloads into a system, execute them directly in memory, and establish persistent access.  <\/p>\n\n\n\n

Classified as a fileless loader<\/a><\/strong>, PSLoramyra bypasses traditional detection methods by loading its primary payload entirely into memory, leaving minimal traces on the system. <\/p>\n\n\n\n

PSLoramyra Loader: Technical Analysis <\/h2>\n\n\n\n

To see PSLoramyra loader in action, let\u2019s have a look at its sample inside ANY.RUN\u2019s sandbox: <\/p>\n\n\n\n

View analysis<\/a> <\/p>\n\n\n

\n
\"\"
PSLoramyra analysis inside ANY.RUN sandbox<\/em><\/figcaption><\/figure><\/div>\n\n\n

Initial PowerShell script <\/h2>\n\n\n\n

Let\u2019s take a closer look at this loader. The infection chain begins with an initial PowerShell<\/a> script that contains both the main malicious payload and the scripts required to execute it. The script performs the following steps: <\/p>\n\n\n\n

    \n
  1. File creation<\/strong>:  <\/li>\n<\/ol>\n\n\n\n

    The script generates three files critical to the infection chain: <\/p>\n\n\n\n

      \n
    1. roox.ps1 <\/li>\n<\/ol>\n\n\n\n
        \n
      1. roox.bat <\/li>\n<\/ol>\n\n\n\n
          \n
        1. roox.vbs <\/li>\n<\/ol>\n\n\n\n
            \n
          1. Execution chain<\/strong>: <\/li>\n<\/ol>\n\n\n\n
              \n
            1. The roox.vbs script is executed first to initiate the process. <\/li>\n<\/ol>\n\n\n\n
                \n
              1. roox.vbs launches the roox.bat script. <\/li>\n<\/ol>\n\n\n\n
                  \n
                1. roox.bat then runs the roox.ps1 PowerShell script. <\/li>\n<\/ol>\n\n\n\n
                    \n
                  1. Payload execution<\/strong>:  <\/li>\n<\/ol>\n\n\n
                    \n
                    \"\"
                    Execution chain of the attack<\/em><\/figcaption><\/figure><\/div>\n\n\n

                    The roox.ps1 script loads the main malicious payload directly into memory using Reflection.Assembly.Load. <\/p>\n\n\n

                    \n
                    \"\"
                    Process tree generated by ANY.RUN sandbox<\/em><\/figcaption><\/figure><\/div>\n\n\n

                    It then leverages RegSvcs.exe to execute the payload. In this case, the payload is the Quasar RAT<\/a>. <\/p>\n\n\n\n\n

                    \n\n

                    \nStart analyzing malware and phishing threats for free<\/span>
                    with ANY.RUN’s Interactive Sandbox  \n<\/p>\n\n                    \nSign up now\n<\/a>\n<\/div>\n\n\n\n