Zscaler ThreatLabz details 2CLoader malware loader

Zscaler’s ThreatLabz research team has published a technical analysis of a newly identified malware loader it tracks as 2CLoader, first observed in August 2026. The loader has been used to distribute information stealers Vidar and Remus, along with the XWorm remote access trojan.

According to the analysis, 2CLoader implements a range of anti-analysis and evasion techniques, including indirect system calls via Hell’s Gate, anti-VM and anti-debug checks, and inline trampoline hooks on Windows APIs. It supports multiple payload execution and persistence mechanisms configured through an embedded PE resource.

ThreatLabz said it has released a Python script to decrypt 2CLoader payloads, and Zscaler’s cloud security platform detects the loader under the threat name Win64.Loader.2CLoader.