A new version of the malicious software “IceXLoader” has infected thousands of home and corporate users through an ongoing phishing campaign.
See also: Couple tried to sell US nuclear warship secrets
The authors of IceXLoader, a malware loader that first appeared this summer, released version 3.3.3, improving the tool's functionality and introducing a multi-stage delivery chain.
In June 2022, Fortinet discovered IceXLoader – a malicious software based on Nim. At that time, it was only at version 3.0 and appeared to be in development due to the lack of basic features.
See also: Russian operator of LockBit ransomware arrested in Canada
On Tuesday, Minerva Labs published a new post warning that the latest version of IceXLoader marks the removal from the beta development stage of the project.
For a malware loader that is being promoted so aggressively in the underground of cybercrime, any evolution of this kind is significant and could lead to a sudden increase in its deployment.
The current delivery method
The infection process begins when the victim clicks on a phishing email containing a ZIP. This ZIP file then downloads the first-stage to the victim's machine.
The extractor creates a new hidden folder (.tmp) in the “C:\Users\\AppData\Local\Temp” area and leaves the executable file , “STOREM~2.exe”.
Depending on the export settings selected by the operator, the infected system may reboot. A new registry key will also be added that deletes the temp folder upon computer restart.
The rejected executable is a downloader that retrieves a PNG file from a hardcoded URL and converts it into an obfuscated DLL file that is the IceXLoader payload.
See also: Venus ransomware: Targets US healthcare organizations
After decrypting the payload, the dropper performs checks to ensure that it is not running inside an emulator and waits 35 seconds before executing the malware loader to avoid sandboxes .
Finally, IceXLoader is injected into the STOREM~2.exe process via the hollowing process.
New IceXLoader
During the first launch, version 3.3.3 of IceXLoader is copied into two directories named after the operator's alias and then collects the following information about the host and exfiltrates it to the C2:
- IP address
- UUID
- Username and machine name
- Windows OS version
- Installed security products
- Presence of .NET Framework v2.0 and/or v4.0
- Hardware information
- Timestamp
To maintain persistence across reboots, the malware loader also creates a new registry key located at “HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run”.
This software uses a memory patching method in the AMSI.DLL file to evade detection by security products such as Windows Defender that use the Antimalware Scan Interface scanning interface of Microsoft Windows.
The loader recognizes the following commands:
- Stop the execution.
- Gathering system information and sending it to C2.
- Display dialog box with a specified message
- Restart the IceXLoader
- To download a file, send a GET request and open it using the “cmd/ C”
- To download the executable file, send a GET request and then execute it from memory.
- This code will load and execute a .NET assembly
- Updating IceXLoader.
- Delete all files from the disk and stop operation
Minerva reports that the people behind this campaign do not want to secure the stolen data, as the SQLite database with the stolen information can be accessed at the C2 address.
The exposed database contains files corresponding to thousands of victims, containing a mix of home and corporate computer infections.
Security researchers have notified the companies appearing in the database about the exposure, but new entries are added daily.
Information source: bleepingcomputer.com
