Loading malware…
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
PHOTOLOADER is a downloader that has been observed to download ICEDID. It makes an HTTP request for a fake image file, which is RC4 decrypted to provide the final payload.
5 distinct techniques documented for this family, organized by ATT&CK tactic.
“MOUSEISLAND is a Microsoft Word macro downloader used as the first infection stage and is delivered inside a password-protected zip attached to a phishing email.”
This data is not downloaded as plaintext but hidden via steganography techniques. At the time of the analysis the data was hidden behind a fake GZIP header, and previously we also observed fake JPG images.
{'campaign_id': 3581911946, 'domains': 'smockalifatori.com', 'key': '5e845c90daccb7f15a824ddf17ebccb65094b386fa909bf6c802f42a295e5dc1'}
“PHOTOLOADER… makes an HTTP request… Host information is sent… via HTTP cookies.” and “SYSTEMBC… receives commands via HTTP…”
Photoloader is the initial loader stage used to load ICEDID
26 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.