New IceXLoader Malware Loader Variant Infected Thousands of Victims Worldwide

An updated version of a malware loader codenamed IceXLoader is suspected of having compromised thousands of personal and enterprise Windows machines across the world.

IceXLoader is a commodity malware that’s sold for $118 on underground forums for a lifetime license. It’s chiefly employed to download and execute additional malware on breached hosts.

This past June, Fortinet FortiGuard Labs said it uncovered a version of the trojan written in the Nim programming language with the goal of evading analysis and detection.

“While the version discovered in June (v3.0) looked like a work-in-progress, we recently observed a newer v3.3.3 loader which looks to be fully functionable and includes a multi-stage delivery chain,” Natalie Zargarov, cybersecurity researcher at Minerva Labs, said in a report published Tuesday.

IceXLoader is traditionally distributed through phishing campaigns, with emails containing ZIP archives functioning as a trigger to deploy the malware. Infection chains have leveraged IceXLoader to deliver DarkCrystal RAT and cryptocurrency miners.

In the attack sequence detailed by Minerva Labs, the ZIP file has been found to harbor a dropper, which drops a .NET-based downloader that, as the name implies, download a PNG image (“Ejvffhop.png”) from a hard-coded URL.

This image file, another dropper, is subsequently converted into an array of bytes, effectively allowing it to decrypt and inject IceXLoader into a new process using a technique called process hollowing.

Version 3.3.3 of IceXLoader, like its predecessor, is written in Nim and is equipped to collect system metadata, all of which is exfiltrated to a remote attacker-controlled domain, while awaiting further commands issued by the server.

The commands include the ability to restart and uninstall the malware loader and halt its execution. But its main feature is to download and execute next-stage malware on disk or filelessly in memory.

Minerva Labs said a SQLite database file hosted in the command-and-control (C2) server is being continuously updated with information about thousands of victims, adding it’s in the process of notifying impacted companies.

Found this article interesting? Follow THN on Facebook, Twitter  and LinkedIn to read more exclusive content we post.