PhotoLoader
Aliases: GZIPLOADER
- First seen
- 2022-03-01 00:00:00
- Malware type
- loader
- Family
- Malware family
- Profile updated
- 2026-07-07 13:03:00
Targeted industries: financial-services healthcare-and-pharmaceutical retail-and-hospitality
Targeted regions: country_code:us country_code:gb country_code:de
Context
A loader used to deliver IcedID, fetching a fake image from which payloads are extracted.
Detection coverage
- 1 YARA rules
Detection rules
- MALPEDIA_Win_Photoloader_Auto (yara-rule)
Reports & references
- Microsoft — Ransomware As A Service Understanding The Cybercrime Gig Economy And How To Protect Yourself (report)
- trellix.com — Conti Leaks Examining The Panama Papers Of Ransomware (report)
- Microsoft — Raspberry Robin Worm Part Of Larger Ecosystem Facilitating Pre Ransomware Activity (report)
- Broadcom/Symantec — Ransomware Hive Conti Avoslocker (report)
- deepinstinct.com — Pindos New Javascript Dropper Delivering Bumblebee And Icedid (report)
- securityintelligence.com — Trickbot Conti Crypters Where Are They Now (report)
- fortinet.com — Notable Droppers Emerge In Recent Threat Campaigns (report)
- Cisco Talos — Following The Lnk Metadata Trail (report)
- isc.sans.edu — 28636 (report)
- twitter.com — 1521816045769662468 (report)
- esentire.com — Icedid To Cobalt Strike In Under 20 Minutes (report)
- thedfirreport.com — From Onenote To Ransomnote An Ice Cold Intrusion (report)
- awakesecurity.com — Detecting Icedid And Cobalt Strike Beacon With Network Detection And Response (report)
- 0x0d4y.blog — Icedid Technical Analysis (report)
- proofpoint.com — Fork Ice New Era Icedid (report)
- Palo Alto Unit 42 — Teasing Secrets Malware Configuration Parsing (report)
- blog.unpac.me — Unpacme Weekly New Version Of Icedid Loader (report)
- silentpush.com — Malicious Infrastructure As A Service (report)
- first.org — Icedid First Ams 2023 (report)
- team-cymru.com — A Visualizza Into Recent Icedid Campaigns (report)
- silentpush.com — Icedid Command And Control Infrastructure (report)
- thedfirreport.com — Icedid Macro Ends In Nokoyawa Ransomware (report)
- isc.sans.edu — 29740 (report)
- spreaker.com — Proofpoint E29 Mix V1 (report)
- Palo Alto Unit 42 — Wireshark Quiz Icedid Answers (report)