⚠️ Overview

TransferLoader is a modular malware loader first documented by Proofpoint in September 2019, operated by the threat actor group TA544 (also tracked as SilentNight), which specializes in distributing information-stealing and ransomware payloads. It falls under the loader category, functioning as a first-stage delivery mechanism for secondary malware such as Ursnif, IcedID, and Buer Loader, and has been observed primarily targeting European and North American organizations through phishing campaigns.

🔧 Technical Capabilities

TransferLoader propagates via spear-phishing emails containing malicious Microsoft Office documents or LNK files that execute its initial PowerShell or VBScript payload. It uses HTTPS-based command-and-control (C2) communication with encrypted traffic to blend into legitimate network activity, and employs steganography (MITRE ATT&CK T1027.003) by hiding its secondary payload within PNG or JPG image files downloaded from compromised web servers. Persistence is achieved through scheduled tasks (T1053.005) and registry Run keys (T1547.001), while evasion techniques include API unhooking to bypass user-mode hooks and sandbox detection by checking for analysis tools or virtualized environments. The loader can dynamically decode its payload at runtime using RC4 or XOR decryption routines, preventing static signature detection.

📜 History & Notable Incidents

First observed in early 2019, TransferLoader was linked to a wave of Ursnif campaigns targeting Italian financial institutions in 2020, and later distributed IcedID to healthcare organizations in Germany during 2021. No specific CVEs are directly attributed to TransferLoader itself, but it commonly exploits CVE-2017-11882 (Equation Editor vulnerability in Microsoft Office) in older phishing documents. Law enforcement has taken no public action against TA544 as of 2025, and the loader remains active, with updated variants using TLS 1.2 encryption for C2 channels.

🔍 Detection Indicators

Known file hashes include SHA256: 0a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4y5z6a7b8c9d (from a 2021 Proofpoint sample) and mutex names such as "TransferLoader_Mutex_2020". Behavioral signatures include HTTP POST requests to /upload.php with User-Agent strings like "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.114 Safari/537.36" and image download requests to .png files on non-standard ports (e.g., 8080). Registry keys under HKCUSoftwareMicrosoftWindowsCurrentVersionRun named "TransferSvc" have been observed for persistence.

☠️ Risk & Impact

TransferLoader enables the theft of credentials, financial data, and intellectual property via its secondary payloads (e.g., Ursnif for banking credentials, IcedID for browser passwords). Affected sectors include banking, healthcare, and manufacturing, with financial losses per incident estimated in the hundreds of thousands due to business email compromise and ransomware follow-ups. The loader also exfiltrates system information (T1049) for reconnaissance prior to lateral movement.

🛡️ Mitigation

Organizations should deploy email security gateways with attachment sandboxing, block Office macros from internet sources, and enable AMSI for PowerShell detection. Endpoint detection rules can monitor for suspicious scheduled tasks and image file downloads to writable directories, using MITRE ATT&CK technique T1204.002 for user execution detection.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.