New IceXLoader Malware Loader Variant Infected Thousands of Victims Worldwide

An updated version of a malware loader codenamed
IceXLoader is suspected of having compromised
thousands of personal and enterprise Windows machines across the
world.

IceXLoader is a commodity malware that’s sold for $118 on
underground forums for a lifetime license. It’s chiefly employed to
download and execute additional malware on breached hosts.

This past June, Fortinet FortiGuard Labs said it uncovered^[1]
a version of the trojan written in the Nim programming language
with the goal of evading analysis and detection.

“While the version discovered in June (v3.0) looked like a
work-in-progress, we recently observed a newer v3.3.3 loader which
looks to be fully functionable and includes a multi-stage delivery
chain,” Natalie Zargarov, cybersecurity researcher at Minerva Labs,
said^[2]
in a report published Tuesday.

IceXLoader is traditionally distributed through phishing
campaigns, with emails containing ZIP archives functioning as a
trigger to deploy the malware. Infection chains have leveraged
IceXLoader to deliver DarkCrystal RAT^[3]
and cryptocurrency miners.

In the attack sequence detailed by Minerva Labs, the ZIP file
has been found to harbor a dropper^[4], which drops a
.NET-based downloader that, as the name implies, download a PNG
image (“Ejvffhop.png”) from a hard-coded URL.

This image file, another dropper, is subsequently converted into
an array of bytes, effectively allowing it to decrypt and inject
IceXLoader^[5]
into a new process using a technique called process hollowing^[6].

Version 3.3.3 of IceXLoader, like its predecessor, is written in
Nim and is equipped to collect system metadata, all of which is
exfiltrated to a remote attacker-controlled domain, while awaiting
further commands issued by the server.

The commands include the ability to restart and uninstall the
malware loader and halt its execution. But its main feature is to
download and execute next-stage malware on disk or filelessly in
memory.

Minerva Labs said a SQLite database file hosted in the
command-and-control (C2) server is being continuously updated with
information about thousands of victims, adding it’s in the process
of notifying impacted companies.