⚠️ Overview

FileIce is a stealer malware first documented in June 2023 by researchers at Fortinet’s FortiGuard Labs, operating as a malware-as-a-service (MaaS) product on Russian-language cybercrime forums such as XSS and Exploit. It is classified as an information stealer that targets credentials, browser data, cryptocurrency wallets, and desktop files, sold to affiliates who pay a monthly subscription fee to access its builder and control panel.

🔧 Technical Capabilities

FileIce collects data from over 35 Chromium-based browsers, 10 Firefox-based browsers, and multiple email clients including Outlook and Thunderbird. It targets cryptocurrency wallet extensions (e.g., MetaMask, Binance Chain Wallet) by reading local storage files and decrypting vaults. The malware uses a C2 infrastructure over HTTPS with URLs employing dynamic DNS domains and base64-encoded paths for exfiltration. Persistence is achieved via a scheduled task or registry Run key, while evasion includes anti-sandbox checks by verifying system uptime, CPU core count, and the presence of VMware or VirtualBox processes. Propagation is limited to initial download via phishing emails or trojanized software installers, with no self-spreading worm capabilities documented.

📜 History & Notable Incidents

FileIce first appeared in underground Russian forums in June 2023, promoted by a developer using the alias “FileIce.” In August 2023, FortiGuard reported a campaign distributing FileIce through SEO-poisoned search results for popular software like “5kPlayer” and “MEmu Emulator,” targeting users in Brazil, India, and the United States. No known CVEs are associated with FileIce, as it relies on social engineering rather than software exploits. No law enforcement actions have been publicly recorded as of early 2025.

🔍 Detection Indicators

Behavioral indicators include file writes to %TEMP% with random 8-character names, network connections to domains such as *.*.lol (e.g., “malicious.lol”) and IP addresses in Russia and the Netherlands. Known mutex names include “FileIce_Mutex” and “Stealer_Mutex_2023”. Registry persistence uses the key “HKCUSoftwareMicrosoftWindowsCurrentVersionRunFileIceUpdater”. File hashes are not widely published due to frequent builder updates, but Fortinet provides YARA rules for generic FileIce payloads.

☠️ Risk & Impact

FileIce poses a high risk of credential theft and cryptocurrency wallet compromise, with the exfiltrated data sold on underground markets for account takeover and financial fraud. The malware primarily targets individual consumers and small businesses, with reported campaigns affecting the technology, financial services, and gaming sectors. No estimates of global financial losses have been publicly disclosed, but the stealer’s low subscription cost (reported at $100–$150/month) makes it accessible to low-sophistication affiliates, increasing the attack surface.

🛡️ Mitigation

Organizations should implement application whitelisting to block unauthorized executables, deploy endpoint detection and response (EDR) tools with YARA detection rules from Fortinet, and enforce multi-factor authentication (MFA) on critical accounts. Users should avoid downloading software from unverified third-party websites and enable browser security extensions that block malicious redirects. Regular scanning for suspicious scheduled tasks and Run keys can detect persistence.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.