A SANS ISC diary entry from mid-September examines a malware loader called LausivLoader. The loader was spotted in a malspam message that appeared at the end of August in the quarantine of a mail gateway run by one of the author's customers.
The email was not especially remarkable at first glance: it asked the recipient to review attached requirements and provide a price quotation for fiber optic work. The diary's focus, however, is not just on the social engineering but on a deeper technical detail—how LausivLoader passes data between malware stages.
Because this is a single source, there are no differing reports to compare. The diary stands alone as a walkthrough of the loader's inter-stage data-passing mechanism, a problem that malware authors commonly need to solve.