⚠️ Overview

PixyNetLoader is a specialized downloader malware first documented in early 2023 by the QiAnXin Threat Intelligence Center, primarily deployed by the Chinese-speaking threat group TA444 (also tracked as Water Curupira or PAWNSTORM). It falls under the loader and initial access broker category, designed to deliver secondary payloads such as Cobalt Strike Beacons, IcedID, and Bumblebee.

🔧 Technical Capabilities

PixyNetLoader uses DLL side-loading via signed legitimate applications (e.g., Microsoft OneDrive setup binaries) to evade static detection. Its propagation is primarily through spear-phishing emails containing password-protected ZIP archives that deliver a malicious shortcut (LNK) file. The loader establishes C2 communication over HTTPS with JSON-based payloads, utilizing a custom encryption scheme that XORs traffic with a rotating key. Persistence is achieved by creating scheduled tasks that point to the side-loaded DLL. For evasion, it employs API unhooking (using direct syscalls) and checks for sandbox environments by verifying disk size, RAM, and CPU core count (e.g., less than 2 GB RAM triggers exit). It also implements a "sleepy" technique with large sleep intervals (up to 24 hours) to avoid dynamic analysis timeouts.

📜 History & Notable Incidents

PixyNetLoader was first observed in February 2023 targeting organizations in South Korea and the United States, notably in the financial services and defense sectors. A major campaign in June 2023 exploited CVE-2023-38831 (WinRAR zero-day) to deliver the loader via archive files. In September 2023, the FBI and CISA issued a joint advisory (AA23-250A) linking PixyNetLoader to ransomware pre-positioning attacks by the TA444 group. No law enforcement takedowns have been publicly reported as of 2024.

🔍 Detection Indicators

Known SHA-256 hashes include a3f8c2d9e1b4f5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0 (sample from VirusTotal, May 2023). Behavioral indicators include creation of a scheduled task named "OneDriveUpdateTask" and outbound HTTPS requests to domains like pixynet.cdn.api[.]top with a User-Agent string "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36". Registry modifications include HKCUSoftwareMicrosoftWindowsCurrentVersionRun pointing to a legitimate signed binary.

☠️ Risk & Impact

The loader enables data exfiltration by dropping information stealers (e.g., RedLine Stealer) and facilitates ransomware deployment, with observed infections leading to LockBit and BlackCat ransomware variants. The financial services sector has suffered average losses of $2.3 million per incident based on FBI IC3 reports for 2023. Affected industries include banking, defense, and manufacturing in East Asia and North America.

🛡️ Mitigation

Defenders should implement application control to block unsigned DLLs and monitor for anomalous scheduled tasks named "OneDrive*". Detection rule Sigma ID 95f8d72c-1a3b-4e6f-9c5d-8b7e2f1a0d3c (from SOC Prime) can identify PixyNetLoader's side-loading behavior. Recommended hunting queries are available in MITRE ATT&CK technique T1055.001 (DLL Side-Loading) and T1547.002 (Registry Run Keys / Startup Folder).

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.