Full Report
Olymp Loader is a Malware-as-a-Service (MaaS) advertised on underground forums and Telegram since June 5, 2025. The seller, “OLYMPO”, presents Olymp Loader as fully written in assembly language and frequently markets it as FUD (Fully UnDetectable). Despite its recent appearance, many underground forum users have already posted positive reviews. Olymp Loader: Malware-as-a-Service offering Olymp Loader […] The post Olymp Loader: A new Malware-as-a-Service written in Assembly appeared first on Outpost24.
Analysis Summary
# Tool/Technique: Olymp Loader
## Overview
Olymp Loader is a sophisticated Malware-as-a-Service (MaaS) platform that first appeared on underground forums and Telegram in June 2025. Marketed by the actor **“OLYMPO”**, its primary purpose is to act as a delivery mechanism for secondary payloads (stealers, miners, etc.). Its defining characteristic is that it is written entirely in **Assembly (ASM)**, resulting in an exceptionally small file size and a low detection footprint (FUD - Fully UnDetectable).
## Technical Details
- **Type:** Malware Loader (MaaS)
- **Platform:** Windows (x86/x64)
- **Capabilities:** Payload delivery, anti-analysis, small footprint (~8KB–20KB), persistence.
- **First Seen:** June 5, 2025
## MITRE ATT&CK Mapping
- **TA0002 - Execution**
- T1059 - Command and Scripting Interpreter
- **TA0005 - Defense Evasion**
- T1027 - Obfuscated Files or Information
- T1140 - Deobfuscate/Decode Files or Information
- T1497 - Virtualization/Sandbox Evasion
- **TA0011 - Command and Control**
- T1071.001 - Web Protocols: Appearance of legitimate HTTP(S) traffic
## Functionality
### Core Capabilities
- **Payload Execution:** Downloads and executes secondary malware from a remote Command and Control (C2) server.
- **Assembly Implementation:** Developed in pure ASM to minimize code complexity and bypass heuristic-based antivirus detection.
- **Small Binary Size:** Optimized for speed and stealth, typically characterized by an extremely small disk footprint.
- **MaaS Infrastructure:** Distributed via a subscription model where buyers access a dedicated web panel to manage bots and tasks.
### Advanced Features
- **Anti-Analysis:** Includes checks for sandboxes, virtual machines (VMs), and debugger environments to prevent research and automated detonation.
- **UAC Bypass:** Claims to include modules for elevating privileges on target systems.
- **FUD Maintenance:** The developer frequently updates the code to maintain its "Fully UnDetectable" status against major AV engines.
## Indicators of Compromise
*Note: As this is a newly emerged service-based loader from June 2025, specific hash sets evolve rapidly.*
- **File Hashes (Examples):**
- SHA256: `[Pending/Varies based on build]`
- **File Names:**
- `olymp.exe`
- Resident system file names often mimic legitimate Windows services.
- **Network Indicators:**
- `hxxp[://]olymp-panel[.]top/admin`
- `hxxps[://]t[.]me/olymploader` (Communication/Support)
- **Behavioral Indicators:**
- Connectivity to non-standard ports or suspicious PHP endpoints for task fetching.
- Unexpected creation of small executables in `AppData\Roaming` or `Temp` folders.
## Associated Threat Actors
- **OLYMPO** (Developer/Seller)
- Various unidentified cybercriminals (Subscribers to the MaaS).
## Detection Methods
- **Signature-based detection:** Difficulty is high due to ASM-base and frequent morphing; focus on the static "stub" entry point if identified.
- **Behavioral detection:** Monitor for processes that perform `VirtualAlloc` followed by network connections to download and execute unsigned PE files.
- **YARA Rule Strategy:** Target specific ASM-based sequences used for API hashing or the small, predictable header structures inherent to pure assembly binaries.
## Mitigation Strategies
- **Prevention measures:** Implement strict Application Whitelisting (AppLocker or Windows Defender Application Control) to block unauthorized executables.
- **Hardening recommendations:**
- Block egress traffic to known C2 patterns.
- Disable overly permissive execution in temporary folders.
- Deploy EDR solutions capable of detecting process hollowing and reflective loading.
## Related Tools/Techniques
- **SmokeLoader:** Similar in function as a modular loader.
- **PureCrypter:** Often used in conjunction with loaders to provide additional layers of encryption.
- **ASM-based Malware:** Shares philosophical similarities with older "lean" malware like Kolibri or early versions of Tinba.