DiceLoader/IcedID2 — e345rt.vbs 237KB, WPF TextFormatting Exploit, .NET Reflection, Base64 Obfuske | Kritik

Arquivo Kimligi

WPF TextFormatting Exploit Kaniti

tropicalnosort="LkZvcm1hdHRpbmcuVGV4dEZvcm1hdHRpbmdSdW5Qcm9wZXJ0aWVzAQAAAA..."

base64 decode =>
.Formatting.TextFormattingRunProperties
ForegroundBrush
-- WPF TextFormattingRunProperties XAML deserialization exploit
-- CVE-2022-30137 / benzer XAML injection RCE pattern

.NET Reflection API Cagirilari

_ModuleNameget_MachineNameget_ScopeNameget_FullNameget_UserDomainName
-- .NET System.Environment ve Machine reflection cagilari
-- Sistem bilgisi toplama (makine adi, domain, kullanici)

Obfuske Fonksiyon Isimleri

Public Function gonesettletongue()
Public Function tippleasesettle()
acrossparticularaverage=  -- base64 encoded payload degiskeni

DiceLoader Hakkinda

DiceLoader, IcedID'nin successor'u olarak da anilan, 2022-2024 doneminde aktif olan bir loader ailesidir. VBScript ile dagitilir, .NET runtime'i XAML deserialization exploit ile suistimal eder. Cobalt Strike, Nokoyawa ransomware ve diger post-exploitation araclariyla zincir olusturur. Genellikle phishing email eki olarak gelir.

IOC