Cybercriminals Employ PhantomLoader to Distribute SSLoad Malware

The nascent malware acknowledged as SSLoad is staying sent by implies of a beforehand undocumented loader identified as PhantomLoader, according to conclusions from cybersecurity company Intezer.

“The loader is additional to a authentic DLL, usually EDR or AV goods, by binary patching the file and employing self-modifying methods to evade detection,” security scientists Nicole Fishbein and Ryan Robinson claimed in a report printed this 7 days.

SSLoad, most likely available to other menace actors underneath a Malware-as-a-Company (MaaS) design owing to its distinct shipping strategies, infiltrates methods by way of phishing email messages, conducts reconnaissance, and pushes additional styles of malware down to victims.

Prior reporting from Palo Alto Networks Device 42 and Securonix has unveiled the use of SSLoad to deploy Cobalt Strike, a genuine adversary simulation software program typically employed for submit-exploitation reasons. The malware has been detected due to the fact April 2024.

The attack chains generally include the use of an MSI installer that, when released, initiates the an infection sequence. Precisely, it leads to the execution of PhantomLoader, a 32-little bit DLL published in C/C++ that masquerades as a DLL module for an antivirus software referred to as 360 Complete Security (“MenuEx.dll”).

The initial-phase malware is designed to extract and run the payload, a Rust-centered downloader DLL that, in switch, retrieves the key SSLoad payload from a remote server, the details of which are encoded in an actor-controlled Telegram channel that servers as dead fall resolver.

Also penned in Rust, the ultimate payload fingerprints the compromised process and sends the data in the variety of a JSON string to the command-and-manage (C2) server, soon after which the server responds with a command to download a lot more malware.

“SSLoad demonstrates its capability to gather reconnaissance, try to evade detection and deploy even more payloads by means of different delivery methods and methods,” the researchers explained, adding its dynamic string decryption and anti-debugging measures “emphasize its complexity and adaptability.”

The advancement arrives as phishing campaigns have also been observed disseminating distant obtain trojans this sort of as JScript RAT and Remcos RAT to enable persistent procedure and execution of instructions gained from the server.

Observed this write-up fascinating? Abide by us on Twitter  and LinkedIn to read much more unique written content we article.

Some areas of this article are sourced from:
thehackernews.com