AVL Code
All cases
#018 · Sample Analysis

Analysis of a Malicious Loader (cspsvc.exe)

To thoroughly analyze a malicious-loader threat, analysts drove AVL Code with a single natural-language instruction, closing the loop from malicious sample to a complete analysis report.

Built with AVL Code + the Landi model

Malicious Loader.NETWindows ServicePowerShellPersistence

Overview

Facing a mere 6.5KB .NET Windows service program, cspsvc.exe, disguised as a system service, analysts drove AVL Code with one natural-language instruction to reverse-engineer its .NET assembly and behavior in depth: identifying its multi-stage malware architecture — persistence via the Windows service framework, bypassing execution policy with -ExecutionPolicy Bypass, and loading an external PowerShell script (cspsvc.ps1) on service start/stop. Since that PowerShell script did not ship with the sample, the report explicitly flags it as needing further capture rather than speculating about its behavior beyond the sample’s own evidence — producing a report with a complete IOC list, a detection-and-removal plan, and a risk-level assessment.

Key results

  • Fully reverse-engineered the 6.5KB .NET Windows service program, reconstructing its multi-stage malware architecture of disguised system service plus external PowerShell loading
  • Identified the Windows-service persistence mechanism and the -ExecutionPolicy Bypass technique, extracting the service name, associated script path and other complete IOCs
  • Explicitly flagged the sample as only a first-stage loader — its actual malicious behavior is determined by an external PowerShell script (cspsvc.ps1) not included with the sample — without speculating about behavior beyond the evidence
  • Generated a detection-and-removal plan and completed a four-dimension risk assessment (stealth / persistence / payload capability / detection difficulty)

Technical highlights

.NET assembly analysisWindows service framework identificationPowerShell loading technique analysisExecution-policy bypass detectionMulti-stage malware architecture identificationAutomated IOC extraction

Practical value

Helps security operations rapidly identify and respond to malicious-loader threats, provides end-to-end guidance from detection to removal, strengthens detection and handling of fileless attacks and multi-stage malware, and effectively protects Windows server security.

Artifacts

View session Download session import into your workspace for full detail View report

Session replays & reports are original records in Simplified Chinese · Built with AVL Code + the Landi model