Trojan:Win64/Shaolaod

Shaolaod initiates its payload deployment in multiple stages. Once the Eldorado dropper is launched, Shaolaod is activated as a second-stage loader, retrieving additional malware payloads from attacker-controlled servers. It runs obfuscated PowerShell scripts to collect browser credentials, decrypt Data Protection API (DPAPI)-protected data, and log user activity. To further conceal its presence, the malware creates named pipes that facilitate silent communication between malicious processes. Shaolaod also abuses legitimate system utilities, such as MSBuild.exe and RegAsm.exe, to load malicious DLLs, ensuring that it remains undetected by antivirus software.

The malware establishes persistence by modifying scheduled tasks and Windows registry entries, allowing it to automatically run upon system reboot. Infected devices frequently exhibit command-and-control (C2) network traffic as the malware communicates with its operators, downloading additional payloads or exfiltrating stolen data.