New IceXLoader Malware Loader Variant Infected Thousands of Victims Worldwide

guest · Nov 10, 2022

By Ravie Lakshmanan - November 9, 2022

An updated version of a malware loader codenamed IceXLoader is suspected of having compromised thousands of personal and enterprise Windows machines across the world.

IceXLoader is a commodity malware that's sold for $118 on underground forums for a lifetime license. It's chiefly employed to download and execute additional malware on breached hosts.
Click to expand...

This past June, Fortinet FortiGuard Labs said it uncovered a version of the trojan written in the Nim programming language with the goal of evading analysis and detection.

"While the version discovered in June (v3.0) looked like a work-in-progress, we recently observed a newer v3.3.3 loader which looks to be fully functionable and includes a multi-stage delivery chain," Natalie Zargarov, cybersecurity researcher at Minerva Labs, said in a report published Tuesday.
Click to expand...

Version 3.3.3 of IceXLoader, like its predecessor, is written in Nim and is equipped to collect system metadata, all of which is exfiltrated to a remote attacker-controlled domain, while awaiting further commands issued by the server.

The commands include the ability to restart and uninstall the malware loader and halt its execution. But its main feature is to download and execute next-stage malware on disk or filelessly in memory.
Click to expand...

Fortinet: New IceXLoader 3.0 – Developers Warm Up to Nim

By Joie Salvio and Roy Tay - June 15, 2022
FortiGuard Labs has encountered version 3.0 of what is now dubbed IceXLoader, a new malware loader being advertised in malware hacking forums.

IceXLoader is a commercial malware used to download and deploy additional malware on infected machines. The latest version is written in Nim, a relatively new language utilized by threat actors the past two years, most notably by the NimzaLoader variant of BazarLoader used by the TrickBot group.
Click to expand...

Minerva: New updated IceXLoader claims thousands of victims around the world

By Natalie Zargarov - November 8, 2022
IceXLoader was discovered last June by FortiGuard Labs. It is a commercial malware used to download and deploy additional malware on infected machines. While the version discovered in June (v3.0) looked like a work-in-progress, we recently observed a newer v3.3.3 loader which looks to be fully functionable and includes a multi-stage delivery chain.
Click to expand...

Log in or Sign up

New IceXLoader Malware Loader Variant Infected Thousands of Victims Worldwide

guest Guest

Log in or Sign up

New IceXLoader Malware Loader Variant Infected Thousands of Victims Worldwide

guest Guest

Useful Searches