EggStreme Malware Emerges With Fileless Techniques and DLL Sideloading Payloads

A Chinese APT group compromised a Philippine military company using a new, fileless malware framework dubbed EggStreme, according to GBHackers. The campaign unfolds through a multi-stage toolset that injects code into memory and uses DLL sideloading to run payloads, with EggStremeAgent acting as a powerful backdoor for system reconnaissance, lateral movement, and data theft via a hidden keylogger.

In early 2024, a Philippine defence contractor became the target of the operation, and investigators linked the activity to a previously unseen framework designed to evade detection and maintain stealthy, long-term access, according to Bitdefender’s insights cited in the piece.

The sequence starts when a logon script on an SMB share deploys WinMail.exe alongside a malicious DLL (mscorsvc.dll) into the %APPDATA%\\Microsoft\\Windows\\Windows Mail\\ directory, after which WinMail.exe sideloads EggStremeFuel to initiate the first-stage loader.

EggStremeLoader then decrypts two payloads—EggStremeReflectiveLoader and EggStremeAgent—from a resource file, with the reflective loader injecting EggStremeAgent into a trusted process entirely in memory, a technique designed to avoid touching disk in plain form.

The EggStremeAgent backdoor communicates with C2 servers over mutual TLS using gRPC, monitors for new user sessions, and upon detecting explorer.exe, decrypts and injects EggStremeKeylogger to capture keystrokes, clipboard contents, and window titles, storing encrypted logs in a hidden file under %LOCALAPPDATA%.

The framework also includes a supplementary backdoor, EggStremeWizard, sideloaded via xwizard.exe, to maintain alternate C2 channels and reverse shell access, while defensive notes highlight the abuse of Windows services and registry parameters to ensure persistence, with a secret (d@rkn3ss) and a listening port (8531) encoded in the tool’s initialisation function.

According to the article, 58 discrete commands enable extensive host reconnaissance, file and directory manipulation, process injection, privilege escalation, lateral movement, and data exfiltration, and there are indications of ongoing, rotating infrastructure through a network of C2 domains and IPs linked by shared certificate authorities.

The piece also calls for defensive measures such as monitoring unusual DLL loads by trusted binaries, anomalous service registry changes, in-memory injection patterns, and enabling comprehensive Windows event logging, underscoring the need to stay vigilant against living-off-the-land techniques observed in this operation.

According to GBHackers, indicators tie this operation to Chinese state-sponsored threat actors, and the story invites readers to join a LinkedIn Live discussion on 18 September to explore the EggStreme framework in depth.