Lost in relocation: analysis of a new loader distributing CASTLESTEALER

Elastic Security Labs discovered and analyzed OXLOADER, a sophisticated Windows loader distributed via malicious Google Ads that stages in-memory execution (using self-modifying decryption stubs, control-flow flattening, MBA, opaque predicates) and abuses the .reloc section to load DonutLoader shellcode which deploys the CASTLESTEALER infostealer; the campaign uses Storj-hosted payloads, contains CIS-region and Russian-language exclusions suggesting a Russian-speaking financially motivated actor, shows low static and sandbox detection, and includes multiple IOCs and YARA rules for defenders.