SecuriTricks - loader

Distribution of Malware Under the Guise of MS Office Cracked Versions (XMRig, OrcusRAT, etc.)

The report analyzes a campaign where threat actors distribute various malware strains like RATs, coinminers, and loaders disguised as cracked versions of popular software. South Korean systems are heavily targeted, with malware persisting via scheduled tasks and evading security products. Detailed …

loader

evasion

Published: May 30, 2024

Downloadable IOCs: 11

New Hijack Loader Variant: Uses Process Hollowing, Has Enhanced Anti-Evasion Capabilities

Published: May 23, 2024

Downloadable IOCs: 9

D3F@ck Loader, the New MaaS Loader

In March 2024, eSentire's Threat Response Unit (TRU) discovered multiple instances of D3F@ck Loader infections being propagated via Google Ads. This new loader, which debuted on hacking forums in January 2024 (Figure 1), can allegedly bypass several key security features such as Google Chrome, Edge…

Published: May 21, 2024

Linked vulnerabilities : CVE-2024-3400

Downloadable IOCs: 3

Spring Cleaning with LATRODECTUS: A Potential Replacement for ICEDID

LATRODECTUS is a malware loader gaining popularity among cybercriminals, with strong connections to the ICEDID malware family. It offers standard capabilities for deploying payloads and conducting post-exploitation activities. Initially discovered by Walmart researchers in 2023, it continues evolvi…

financially-motivated

Published: May 17, 2024

Downloadable IOCs: 7

Code Emulation and Cybercrime Infrastructure Discovery

This report details the analysis of a malspam campaign utilizing the Matanbuchus loader, which involved decrypting strings within the malware through emulation techniques. The investigation pivoted to uncover a Russian bulletproof hosting service, Proton66 OOO, that currently hosts various maliciou…

Published: May 8, 2024

Downloadable IOCs: 76

Tag: loader

Attack reports

Two sides of the same coin

Melting Pot of macOS Malware Adds Go to Crystal, Nim and Rust Variants

BabbleLoader

Hello again, FakeBat: popular loader returns after months-long hiatus

New wave of Bumblebee malware attacks warned

New Bumblebee Loader Infection Chain Signals Possible Resurgence

HijackLoader evolution: abusing genuine signing certificates

Core Werewolf hones its arsenal against Russia’s government organizations

Arsenal honed against Russia's government organizations

Wreaking havoc in cyberspace: threat actors experiment with pentest tools

Cuckoo Threat Actor Arsenal

Loki: a new private agent for the popular Mythic framework

Exploring the D3F@ck Malware-as-a-Service Loader

Ande Loader Leads to 0bj3ctivity Stealer Infection

A Dive into Latest Campaign

DodgeBox: A deep dive into the updated arsenal of APT41

Exposing FakeBat loader: distribution methods and adversary infrastructure

Distribution of Malware Under the Guise of MS Office Cracked Versions (XMRig, OrcusRAT, etc.)

New Hijack Loader Variant: Uses Process Hollowing, Has Enhanced Anti-Evasion Capabilities

D3F@ck Loader, the New MaaS Loader

Spring Cleaning with LATRODECTUS: A Potential Replacement for ICEDID

Code Emulation and Cybercrime Infrastructure Discovery