Loading story…
Elastic Security Labs documented how to unpack ICEDID’s fake-GZip variant, a credential- and banking-information-stealing malware family that uses custom file formats and encryption to impede analysis. The examined sample contained an encrypted configuration, core binary, and persistence loader; recovered configuration data identified alishaskainz[.]com and villageskaier[.]com as C2 domains and /news/ as the beacon URI. The workflow reconstructs ICEDID custom PE files, including x64 and x86 browser-hook payloads, for static analysis; execution should be limited to isolated environments.
Separately, Malpedia published an autogenerated YARA signature for Windows DarkVNC. The rule evaluates ten byte-pattern sequences and matches files below 606,208 bytes when at least seven patterns are present, providing a detection option for the remote-access malware family. The reference does not attribute DarkVNC to a specific incident, campaign, or threat actor.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
ICEDID became more prevalent following Emotet's temporary disruption in early 2021. ICEDID has also been linked to distribution of DarkVNC and Cobalt Strike.
IBM X-Force researchers discovered the ICEDID malware family, which is used to steal login credentials, banking information, and other personal data.
A YARA rule named win_darkvnc_auto was autogenerated by yara-signator v0.6.0 to detect the win.darkvnc malware family. The rule requires at least seven of ten byte-pattern sequences to match in files smaller than 606,208 bytes.
Elastic Security Labs released tooling using the nightMARE module to extract and decrypt ICEDID fake-GZip components and rebuild its custom PE payloads. Its analysis identified an examined sample's C2 domains as alishaskainz[.]com and villageskaier[.]com, with /news/ used for beaconing.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that **IcedID** (also known as **BokBot**) continued to evolve from a banking trojan into a multi-stage malware platform widely used to establish initial access for ransomware intrusions. Across observed campaigns, phishing emails delivered password-protected ZIP archives, malicious Word or Excel documents, or zipped JavaScript files that launched HTA scripts and DLL loaders through tools such as `rundll32`, `regsvr32`, and `mshta.exe`. Analysts documented several loader techniques, including disguised DLLs saved with `.jpg` extensions, registry-stored configuration data derived from victim-specific bot IDs, and even PNG steganography used to hide encrypted shellcode. Later reporting also described PhotoLoader and GzipLoader variants, including a newer GzipLoader build that added dynamic API resolution and XOR-based stacked-string encryption while dropping earlier SSL-pinning behavior, changes that risked breaking older pattern-based detections. Incident responders and threat researchers linked IcedID infections to financially motivated intrusion clusters that rapidly escalated to **MAZE** and later **EGREGOR** ransomware. Mandiant said UNC2198 repeatedly leveraged access originating from the MOUSEISLAND → PHOTOLOADER → ICEDID chain, then deployed tooling including **SYSTEMBC**, **WINDARC**, **Cobalt Strike BEACON**, **METERPRETER**, **KOADIC**, and **PowerShell EMPIRE** for discovery, lateral movement, and privilege escalation, including observed abuse of `CVE-2020-0787`. In multiple cases, attackers used **BloodHound**, moved laterally over WinRM and RDP, exfiltrated data with **RCLONE**, and encrypted victim environments within days. Defenders published YARA rules, unpacking workflows using **Qiling**, registry- and network-based hunting methods, and configuration extractors to recover domains, campaign IDs, and other indicators from packed IcedID samples.
Aug 15, 2026
Researchers detailed two separate malware chains that rely on deeply layered staging, DLL sideloading, and trusted signed software to conceal execution. One campaign, dubbed **Eimeria**, starts from a `RAR5` archive containing the signed `dsclock.exe`, a malicious `zlibwapi.dll`, and an encrypted payload that decrypts into an IExpress package and then an AutoIt-based RunPE loader. The chain restores `ntdll.dll` to evade EDR hooks, decrypts later stages with `AES-128-CBC`, `RC4`, and `LZNT1`, hollows `explorer.exe`, `svchost.exe`, or `taskhostw.exe`, and injects a small .NET RAT that beacons over WebSocket to `94.26.90.139:3006`. It also sets persistence through a Run key and scheduled task and uses delays, sleep checks, and CPU and memory stress tests to frustrate analysis. A second intrusion set tied to **UAC-0184 / MB-0007** used Ukraine-themed lures and messenger delivery to target Ukrainian Defense Forces personnel, beginning with `LNK` files that called `bitsadmin` to fetch `HTA` content from `169.40.135.35` for execution via `mshta`. The downloaded archive abused legitimate Plane9 components for sideloading through `Cluster-Overlay64.exe`, `Plane9Engine.dll`, and `openvr_api.dll`, then decoded `kernel-diag.lib` into `evr.dll` and unpacked `filter.bin` by rebuilding `IDAT` chunks, XOR-decoding with key `0x227E9BDE`, and decompressing with `LZNT1`. The final bundle included signed utilities such as Microsoft-signed `VSLauncher.exe` and a renamed PassMark Endpoint DLL, indicating the actor likely repurposed a signed network stack and dump-capable tooling for covert internal communications, with controller details possibly discovered dynamically over multicast `224.0.0.255:31339` and TCP `31339` rather than a fixed external C2.
Jun 29, 2026
Researchers and developers published details and tooling that expose how the **Ezuri** ELF crypter conceals Linux malware in memory and how packed payloads can be recovered. Analysis cited from AT&T Alien Labs described malware using the Ezuri memory loader, which encrypts payloads with **AES in CFB mode**, stores the key and IV inside the binary, and then decrypts and executes the payload from memory using `memfd_create` to reduce on-disk artifacts. A public GitHub project, **`ezuri_unpack`**, was released to automate extraction of payloads from Ezuri-packed binaries. The tool is presented as a simple Go-based unpacker built from prior reverse-engineering work and was reportedly tested against a packed **Linux.Cephei** sample referenced in the Alien Labs research, giving defenders and analysts a practical way to inspect malware hidden by the Ezuri loader.
Aug 15, 2026