PHOTOFORK
- First seen
- 2023-02-01 00:00:00
- Malware type
- downloader, loader
- Profile updated
- 2026-07-07 13:13:47
Targeted industries: financial-services technology-and-telecommunications
Context
PHOTOFORK is a downloader which is a modified version of GZIPLOADER. It was first detected in February 2023 and was distributed by TA581 along with an unattributed threat activity cluster that facilitated initial access. In this version, the configuration file is no longer encrypted using a simple XOR algorithm with a 64-byte key. Instead, it uses a custom algorithm previously used by the Standard core loader. This algorithm decrypts DLL strings that are needed to resolve handles to the necessary DLLs later on. The strings are decrypted using an algorithm that splits the data into DWORDs and XORs it against a random key. The main objective of PHOTOFORK remains the same as GZIPLOADER, i.e. to deliver an encrypted bot and core DLL loader (forked) that loads the Forked ICEDID bot into memory using a custom PE format.
Detection coverage
- 1 YARA rules
Detection rules
- MALPEDIA_Win_Photofork_Auto (yara-rule)
Reports & references
- proofpoint.com — Security Brief Ta571 Delivers Icedid Forked Loader (report)
- proofpoint.com — Fork Ice New Era Icedid (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Photofork (report)