{"id":9103,"date":"2024-10-07T12:05:10","date_gmt":"2024-10-07T12:05:10","guid":{"rendered":"\/cybersecurity-blog\/?p=9103"},"modified":"2024-10-08T10:35:39","modified_gmt":"2024-10-08T10:35:39","slug":"phantomloader-and-ssload-analysis","status":"publish","type":"post","link":"https:\/\/any.run\/cybersecurity-blog\/phantomloader-and-ssload-analysis\/","title":{"rendered":"New PhantomLoader Malware Distributes SSLoad: Technical Analysis"},"content":{"rendered":"\n

Editor\u2019s note: The current article is authored by Mohamed Talaat, a cybersecurity researcher and malware analyst. You can find Mohamed on X<\/a> and LinkedIn<\/a>.<\/em><\/p>\n\n\n\n

In this malware analysis report, we take an in-depth look at how an undocumented loader called PhantomLoader has been used by attackers to distribute a rust-based malware known as SSLoad<\/a>.<\/p>\n\n\n\n

Overview<\/h2>\n\n\n\n

The PhantomLoader usually masquerades as a legitimate 32-bit DLL written in C\/C++ for an antivirus software called 360 Security Total.<\/p>\n\n\n\n

However, in this case, it was found disguising itself as “PatchUp.exe,” which is still a legitimate module of 360 Total Security. This loader has been used in recent attacks to deliver a new rust-based malware called SSLoad.<\/p>\n\n\n\n

What makes PhantomLoader unique is that it was added to be part of a legitimate DLL or executable of a well-known software by binary patching the DLL or executable and adding a self-modifying technique. The latter decrypts an embedded code stub, which then decrypts and loads “SSLoad” into memory.<\/p>\n\n\n\n

\"\"
PatchUp.exe and legitimate module of 360 Total Security<\/em><\/figcaption><\/figure>\n\n\n\n

Technical<\/strong> analysis<\/strong><\/h2>\n\n\n\n

After analyzing the SSLoad sample in ANY.RUN\u2019s sandbox<\/a>, we observed that one distribution method for this malware involves phishing emails containing malicious Office documents. These documents initiate the infection chain.<\/p>\n\n\n\n

The analysis session shows how the drop and execution of PhantomLoader occurs, after which it decrypts and runs SSLoad.<\/p>\n\n\n\n

View the analysis session<\/a><\/p>\n\n\n

\n
\"\"
The detection of SSLoad malware inside ANY.RUN\u2019s sandbox<\/em><\/figcaption><\/figure><\/div>\n\n\n

Execution of Malicious Word document<\/strong><\/h3>\n\n\n\n

After executing the malicious Word document, it became clear that a new process, “app.com,” was launched by “WINWORD.exe,” indicating that an embedded malicious macro had been executed. This resulted in the creation of the suspicious process. <\/p>\n\n\n

\n
\"\"
Malicious Word document displayed in ANY.RUN\u2019s sandbox<\/em><\/figcaption><\/figure><\/div>\n\n\n

To better understand the infection chain, the macro was extracted and analyzed further.<\/p>\n\n\n\n\n

\n\n

\nAnalyze malware and phishing threats
in ANY.RUN’s Interactive Sandbox<\/span>  \n<\/p>\n\n\nTry it now\n<\/a>\n<\/div>\n\n\n\n