Cybercriminals Employ PhantomLoader to Distribute SSLoad Malware

The nascent malware regarded as SSLoad is getting shipped by suggests of a formerly undocumented loader identified as PhantomLoader, according to findings from cybersecurity company Intezer.

“The loader is extra to a respectable DLL, commonly EDR or AV items, by binary patching the file and employing self-modifying techniques to evade detection,” security scientists Nicole Fishbein and Ryan Robinson explained in a report revealed this 7 days.

SSLoad, most likely offered to other risk actors underneath a Malware-as-a-Services (MaaS) model owing to its various delivery solutions, infiltrates methods by means of phishing email messages, conducts reconnaissance, and pushes more sorts of malware down to victims.

Prior reporting from Palo Alto Networks Device 42 and Securonix has uncovered the use of SSLoad to deploy Cobalt Strike, a legit adversary simulation application typically employed for publish-exploitation uses. The malware has been detected since April 2024.

The attack chains usually entail the use of an MSI installer that, when released, initiates the infection sequence. Particularly, it potential customers to the execution of PhantomLoader, a 32-little bit DLL prepared in C/C++ that masquerades as a DLL module for an antivirus application referred to as 360 Whole Security (“MenuEx.dll”).

The to start with-stage malware is made to extract and run the payload, a Rust-centered downloader DLL that, in turn, retrieves the most important SSLoad payload from a remote server, the details of which are encoded in an actor-managed Telegram channel that servers as dead drop resolver.

Also composed in Rust, the final payload fingerprints the compromised process and sends the data in the kind of a JSON string to the command-and-handle (C2) server, right after which the server responds with a command to download far more malware.

“SSLoad demonstrates its functionality to acquire reconnaissance, endeavor to evade detection and deploy even further payloads by various shipping procedures and strategies,” the researchers claimed, including its dynamic string decryption and anti-debugging measures “emphasize its complexity and adaptability.”

The advancement arrives as phishing strategies have also been observed disseminating distant entry trojans these kinds of as JScript RAT and Remcos RAT to help persistent procedure and execution of commands been given from the server.

Observed this short article appealing? Stick to us on Twitter  and LinkedIn to browse much more unique written content we publish.

Some parts of this article are sourced from:
thehackernews.com