GachiLoader: Defeating Node.js Malware with API Tracing

GachiLoader is a heavily obfuscated Node.js JavaScript malware used to deploy additional payloads to an infected machine, identified in a campaign linked to the YouTube Ghost Network. According to Check Point Research, one variant downloads a remote payload while a second drops a loader named kidkadi[.]node that uses a novel Vectored Overloading technique to load a payload via reflective PE loading.

The campaign involved more than a hundred videos across 39 compromised accounts, with the first video uploaded on 22 December 2024 and roughly 220,000 views to date. Check Point Research also notes that some samples drop Rhadamanthys as the final payload, with multiple C2 addresses embedded for redundancy and a Base64-encoded final payload behind a secret header.

To aid analysis, they developed an open-source Node.js tracer, available at https://github[.]com/CheckPointSW/Nodejs-Tracer, which bypasses anti-analysis checks and exposes the malware’s actions. The researchers emphasise that the final payloads are typically packed and protected by Themida or VMProtect, underlining the ongoing use of Node.js-based malware in the threat landscape.