new-icexloader-malware-loader-variant-infected-thousands-of-victims-worldwide

Share news article

Share on facebook
Share on twitter
Share on linkedin
Share on email

New IceXLoader Malware Loader Variant Infected Thousands of Victims Worldwide

An updated version of a malware loader codenamed IceXLoader is suspected of having compromised thousands of personal and enterprise Windows machines across the world.

IceXLoader is a commodity malware that’s sold for $118 on underground forums for a lifetime license. It’s chiefly employed to download and execute additional malware on breached hosts.

This past June, Fortinet FortiGuard Labs said it uncovered a version of the trojan written in the Nim programming language with the goal of evading analysis and detection.

“While the version discovered in June (v3.0) looked like a work-in-progress, we recently observed a newer v3.3.3 loader which looks to be fully functionable and includes a multi-stage delivery chain,” Natalie Zargarov, cybersecurity researcher at Minerva Labs, said in a report published Tuesday.

IceXLoader is traditionally distributed through phishing campaigns, with emails containing ZIP archives functioning as a trigger to deploy the malware. Infection chains have leveraged IceXLoader to deliver DarkCrystal RAT and cryptocurrency miners.

In the attack sequence detailed by Minerva Labs, the ZIP file has been found to harbor a dropper, which drops a .NET-based downloader that, as the name implies, downloads a PNG image (“Ejvffhop.png”) from a hard-coded URL.

This image file, another dropper, is subsequently converted into an array of bytes, effectively allowing it to decrypt and inject IceXLoader into a new process using a technique called process hollowing.

Version 3.3.3 of IceXLoader, like its predecessor, is written in Nim and is equipped to collect system metadata, all of which is exfiltrated to a remote attacker-controlled domain, while awaiting further commands issued by the server.

The commands include the ability to restart and uninstall the malware loader and halt its execution. But its main feature is to download and execute next-stage malware on disk or filelessly in memory.

Minerva Labs said a SQLite database file hosted in the command-and-control (C2) server is being continuously updated with information about thousands of victims, adding it’s in the process of notifying impacted companies.


Found this article interesting? Follow THN on Facebook, Twitter and LinkedIn to read more exclusive content we post.

Related News

Hackers using USB drives to spread malware in ongoing attack

Hackers using USB drives to spread malware in ongoing attack

According to a recent post by the cybersecurity firm Mandiant, USB drives are being used to hack targets in Southeast…
AI-Powered Smart Glasses Give Deaf People the Power of Speech

AI-Powered Smart Glasses Give Deaf People the Power of Speech

In a recent example of innovative technology making a positive difference, there is now new artificial intelligence (AI) powered smart…
16,000+ Scam Domains Aimed at FIFA World Cup Fans in Qatar

16,000+ Scam Domains Aimed at FIFA World Cup Fans in Qatar

Seeing as scammers readily jump to capitalize on events with huge global interest, it comes as no surprise that Group-IB…