CYPHERLOCK, INC.

TransferLoader: A Sophisticated Malware Loader Redefining Command Execution and Payload Delivery

A new player in the malware ecosystem, TransferLoader, is rapidly gaining attention for its advanced capabilities and real-world impact. More than just another loader, it acts as a modular attack enabler, arming threat actors with tools to remotely execute commands and deploy damaging payloads—including the Morpheus ransomware, used in a recent breach of a U.S.-based legal firm.

Discovered in early 2025 by Zscaler’s ThreatLabz team, TransferLoader is engineered for stealth and adaptability. Its decentralized architecture and layered evasion techniques allow it to bypass traditional defenses, making detection and mitigation a serious challenge.

At the core of its operation lies a three-phase attack chain:

• Initial Downloader: Fetches secondary payloads.
• Command Backdoor: Facilitates attacker-controlled operations on the host.
• Configuration Loader: Manages runtime parameters and updates.

A standout feature is its fallback control mechanism using the InterPlanetary File System (IPFS)—a decentralized file-sharing protocol. Even if its primary servers are dismantled, TransferLoader maintains persistence by shifting C2 communications to IPFS, frustrating efforts to contain it.

Its backdoor component supports both encrypted HTTPS and raw TCP, offering multiple channels for attacker interaction. IPFS usage also introduces traffic camouflage, blending malicious operations with legitimate web activity and making signature-based detection largely ineffective.

Engineered for Obfuscation

TransferLoader doesn’t just hide—it resists. Obfuscation is deeply embedded into its architecture:

• Dynamic API resolution and junk code injection thwart reverse engineering.
• Multi-layered encryption hides internal logic.
• Execution checks prevent sandbox analysis, such as validating the BeingDebugged flag in memory and requiring precise command-line input to activate.

Strategic Implications

What sets TransferLoader apart isn’t just its technical complexity, but its strategic adaptability. Its decentralized C2 fallback, stealth communications, and modular payload delivery model position it as a high-priority threat. As defenders adapt, so too does TransferLoader—an emerging standard-bearer for modern malware operations.

Disruptive Obfuscation in TransferLoader: A Closer Look at Code Diversion and String Masking

Visual: Disassembly view of obfuscation sequence (Credit: Zscaler)

To undermine reverse engineering efforts, TransferLoader introduces deliberate chaos into its codebase through engineered clutter—blocks of instructions that serve no functional purpose. These fragments, filled with irrelevant stack manipulations and dead-end CALL operations, are strategically woven into the binary to pollute control flow analysis. Automated disassemblers falter, forcing human analysts to manually trace the legitimate execution paths—often a time-consuming task.

On the data protection front, TransferLoader conceals sensitive strings—including command-and-control endpoints and Windows API identifiers—behind lightweight XOR-based encryption. Using 8-byte keys, the malware obscures plaintext references and reconstructs strings at runtime, directly on the stack. This real-time decryption ensures that no useful indicators are visible in static code, further complicating detection and analysis.

On-the-Fly String Unmasking in TransferLoader

Illustration: Live decryption logic in action (Credit: Zscaler)

TransferLoader doesn’t store sensitive strings in plaintext. Instead, it relies on just-in-time decryption to unmask critical values—like API names or C2 domains—only at the moment they’re needed. This technique effectively sidesteps static analysis and signature-based detection tools.

In one illustrative instance, the malware decrypts a 6-byte value using a hardcoded 64-bit key (0x7EFFA11A3315E0BC). Here’s a conceptual breakdown in Python that mirrors its internal logic:

Python

encrypted = [0xE0, 0xE0, 0x24, 0x33, 0x1A, 0xA1]
key = 0x7EFFA11A3315E0BC
decrypted = bytearray()

for i in range(len(encrypted)):
shift = 8 * (i % 8)
decrypted_byte = (key >> shift) ^ encrypted[i]
decrypted.append(decrypted_byte & 0xFF)

Rather than relying on obfuscation alone, this method introduces runtime entropy, ensuring that vital strings don’t exist in a readable form within the binary. Until decrypted in memory, they remain invisible—both to analysts and automated tooling.

TransferLoader’s Control Flow Camouflage: Offset Jumps and Arithmetic Misdirection

Snapshot: Obfuscation logic within execution stream (Credit: Zscaler)

TransferLoader actively disrupts code comprehension by weaving in nonlinear control flow tactics. It leverages two distinct methods to veil true execution paths and frustrate both analysts and automated decompilers.

The first technique manipulates jump logic through calculated offsets rather than direct targets. Instead of using a straightforward jmp to a labeled address, the malware performs on-the-fly math to derive its destination:

assembly

lea rax, loc_140016892
sub rax, 0x13CE1 ; Dynamic offset applied
jmp rax

This runtime address computation conceals control flow transitions, rendering static code mapping ineffective without manual resolution.

Meanwhile, the second strategy, reserved for embedded or stage-two payloads, utilizes SIMD registers (typically used for parallel processing) to hide critical runtime values. It further cloaks variable assignments by flooding the code with superfluous arithmetic operations, forcing reverse engineers to peel back layers of irrelevant math to locate real logic.

Together, these approaches form a deliberate smokescreen—designed not just to delay analysis, but to weaponize complexity as a form of resistance.

TransferLoader’s Obfuscation Engine: Data Flow Disruption by Design

Illustration: Register scrambling in runtime execution (Source: Zscaler)

At the heart of TransferLoader’s evasion strategy lies a dynamic obfuscation engine that actively scrambles data flow. Instead of assigning values directly, the malware performs bitwise transformations—shifts, rotates, and masks—across registers, making it difficult for analysts to track how variables evolve across execution stages. This level of obfuscation not only frustrates static analysis but also complicates dynamic inspection.

More broadly, TransferLoader marks a notable evolution in adversarial tooling, blending modular architecture with hardened infrastructure and layered concealment:

• Payload modularity allows attackers to tailor infections with precision.
• Decentralized C2 through IPFS ensures resilience even in the face of takedown attempts.
• Obfuscation at every tier—from loader logic to runtime execution—impairs detection and analysis efforts.

Zscaler has integrated proactive detection rules across its cloud ecosystem, targeting key indicators such as:

• Known C2 endpoints (e.g., https://mainstomp[.]cloud/MDcMkjAxsLKsT)
• Payload fingerprints (e.g., hash b55ba0f869f64...)

Security teams should prioritize monitoring for anomalous IPFS traffic, especially outbound connections involving unknown hashes or gateway activity. Additionally, enforcing strict controls around dynamic API usage can limit TransferLoader’s ability to interface with system internals undetected.