JSDropperLoader

JavaScript malware dropper with 3-layer encryption: XOR(20/142) outer, custom AES-256 with modified S-BOX/RCON, then embedded PowerShell loader. Targets MSBuild.exe via process hollowing. Uses OmniCascade assembly namespace (QuartzMediator, PhantomLinker). ConvertFrom-Base28 custom encoding for embedded blobs. Execution via WScript.Shell.Run() and ADODB.Stream. Consistent with XLoader/ModiLoader/IDAT-style loaders.