Loading malware…
IDAT Loader is a Windows malware loader first observed by Rapid7 in July 2023. It is described as a sophisticated loader used in fake browser update and ClearFake-driven infection chains to deliver follow-on malware including Lumma Stealer, StealC, Amadey, and in earlier variants SecTop RAT. The loader gets its name from storing an encrypted malicious payload inside the IDAT chunk of a PNG-formatted file.
In the reported chains, victims are lured via compromised websites using fake browser update pages; ClearFake campaigns in October 2023 also delivered IDAT Loader to Windows systems. Rapid7 described a flow in which a fake updater such as ChromeSetup.exe downloads and executes an MSI. The MSI drops a legitimate executable such as VMwareHostOpen.exe or pythonw.exe together with a malicious DLL such as vmtools.dll or python311.dll and an encrypted .log file masquerading as PNG data. The malicious DLL uses API hashing to resolve kernel32.dll and ntdll.dll functions, locates the embedded payload by searching for the IDAT chunk and marker bytes, decrypts it with XOR, decompresses it with RTLDecompressBuffer using LZNT1, then loads mshtml.dll and overwrites its .text section in memory with the decompressed code.
Subsequent stages create a randomized folder under %APPDATA%, relaunch the legitimate host process from that location, and inject into a spawned cmd.exe using NtCreateSection and NtMapViewOfSection. The injected loader reads configuration from %TEMP%\89680228, decrypts it with recursive XOR key 3D ED C0 D3, deletes the initial malicious DLL, and injects the final payload into explorer.exe using Process Doppelgänging with Transactional NTFS APIs including NtCreateTransaction, NtCreateFile, NtWriteFile, NtRollbackTransaction, NtCreateProcessEx, and NtCreateThreadEx. Reported evasion techniques include Heaven’s Gate for many API calls and NtDelayExecution-based delays to hinder sandbox analysis.
Observed packaging varies, but Rapid7 reported IDAT Loader being packaged as DLLs loaded by legitimate programs including VMwareHost, Python, and Windows Defender components. Known filenames and artifacts directly mentioned in reporting include ChromeSetup.exe, vmtools.dll, python311.dll, vmo.log, pz.log, and %TEMP%\89680228; Rapid7 also noted vmtools.dll searched for the string "...IDAT" and marker bytes C6 A5 79 EA in the PNG-like file. Detection content provided for Windows memory scanning specifically targets IDAT Loader and associated payloads such as Stealc, Lumma, Amadey, and RedLine.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
12 distinct techniques documented for this family, organized by ATT&CK tactic.
"IDAT immediately started the implementation of the Heaven’s Gate evasion technique..." and repeated use of low-level NT APIs (e.g., NtCreateSection, NtMapViewOfSection, NtCreateTransaction).
"Victims are prompted to download and run a fake application..." and "instructions ... urges targets to run an executable file (\"setup.exe\")"
"It will also drop an encrypted vmo.log file which has a PNG file structure" and "IDAT loader got its name as the threat actor stores the malicious payload in the IDAT chunk of PNG file format."
"IDAT injects code into cmd.exe process by using NtCreateSection + NtMapViewOfSection Code Injection"
"The loader finally injects the infostealer code into the explorer.exe process by using the Process Doppelgänging injection technique."
"The DLL... decrypts it using a bitwise XOR... reads the contents from vmo.log... attempts to decrypt... decompressed using the RTLDecompressBuffer function... LZNT1"
"ChromeSetup.exe downloads and executes the Microsoft Software Installer (MSI) package..." and "switches intended to avoid detection: /qn /quiet /norestart"
37 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Loader malware delivered by ClearFake to Windows systems as part of its infection chain.
Multi-stage loader used in fake browser update (“Fake Browser Update”) drive-by campaigns. It is delivered via MSI and DLL search order hijacking, decrypts an embedded payload stored in a PNG-like file (IDAT chunk), uses multiple evasion/injection techniques (Heaven’s Gate, NtCreateSection/NtMapViewOfSection injection, Process Doppelgänging), and ultimately injects commodity infostealers/RATs into processes such as explorer.exe.
IDAT Loader is a malware loader used to execute additional payloads in memory. It has been observed in the wild delivering infostealers such as Stealc and Lumma. It uses various obfuscation and encryption routines to evade detection and facilitate the execution of its final payloads.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.