Rugmi
Rugmi is a malware loader ecosystem also tracked as HijackLoader and IDAT Loader. It is described as a Malware-as-a-Service/pay-per-install loader first observed in 2023 and used to distribute multiple payloads including Aurora Stealer, Rhadamanthys Stealer, SectopRAT, DanaBot, CryptBot, Vidar Stealer, and in related reporting LummaStealer and DeerStealer. The content describes a fully decrypted Stage 4 Rugmi/HijackLoader sample delivering Aurora Stealer as the final payload.
In the analyzed chain, Rugmi uses a custom binary container and aggressive DLL sideloading with legitimate signed binaries. Embedded components include Sysinternals tcpvcon.exe used to sideload a malicious pla.dll via DLL search order hijacking, and a launcher disguised as jpegoptim.exe that causes Windows to load a local malicious d3d9.dll/Register.dll. The loader uses runtime API resolution, has components with no import table, and includes modules associated with cleanup or memory wiping. Observed behavior includes writing tcpvcon.exe and pla.dll to %APPDATA%, executing tcpvcon.exe /accepteula, writing EngineX-Aurora.exe with d3d9.dll or Register.dll to disk, and executing the launcher to trigger a second sideloading stage. Persistence and execution behaviors mentioned in the content include copying itself to %LOCALAPPDATA%\RaScope.exe, adding RaScope.exe to the Windows Startup folder, Living-off-the-Land execution via MSBuild.exe, process injection into explorer.exe, and modules identified as modUAC64 for UAC bypass and modTask64 for scheduled task creation.
The final payload in the detailed sample is assessed as Aurora Stealer, with theft of browser credentials from Chrome, Firefox, and Edge, cookie and session-token harvesting, cryptocurrency wallet theft, file exfiltration, and encrypted command-and-control communications. The command-and-control configuration was stored in a high-entropy encrypted blob and could not be statically recovered in that analysis. The sample contained the campaign identifier xy_Alt_betav1 and a PDB path exposing the username xmr. Related reporting in the content also places Rugmi in delivery chains used by LummaStealer and describes a DeerStealer affiliate operating within the Rugmi loader ecosystem.
Targeting noted in the content includes related IDAT Loader campaigns against Ukrainian organizations. Infrastructure and delivery references directly mentioned include shift-art.com and 37.140.192.197 for Rugmi MSI delivery. File and path indicators directly cited include stage_4_decrypted_payload.bin (SHA-256 c89f99602d833822c0954ac0266580919816da23b2adeb820dcf8b5639afb04a), tcpvcon.exe (SHA-256 e202f137869cce7fdea6b6cd1169f5e0b6a46cc2d89265a31f63484b0f48bb29), tinystub64.bin/Register.dll (SHA-256 729e5965e43ff458f6da901536c9a43be52a3820718e2dd5456150e2d73bb97f), EngineX-Aurora.exe/jpegotim-themed launcher (SHA-256 c52664283a0dc2c3d500b236ce2d5379802c0d74d903da6b3e133b2de6e77949), %APPDATA%, %LOCALAPPDATA%\RaScope.exe, and the malicious DLL names pla.dll, d3d9.dll, and Register.dll.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
2 distinct techniques documented for this family, organized by ATT&CK tactic.
Execution
2 techniques
Execution
"Our analysis shows that LummaStealer infections are primarily driven by social engineering rather than by the exploitation of technical vulnerabilities. Malware campaigns consistently rely on users unwittingly running infected files, using simple lures such as fake cracked software, fake games or media downloads, and abuse of trusted platforms."
IOCs tracked for this family
14 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Rugmi is referenced as the loader ecosystem used by the affiliate to deliver DeerStealer through malvertising and deceptive software installers.
Referenced only as part of related infrastructure in the broader cluster; the content does not provide further malware functionality details.
A MaaS/pay-per-install loader ecosystem that uses DLL sideloading, LoTL via MSBuild.exe, persistence through the Startup folder, process injection, and staged payload delivery. In this sample it delivers Aurora Stealer.
Referenced as a loader used in some LummaStealer delivery chains for initial execution (no further technical detail provided in the content).
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.