Tomorrow night ? Honeymoon on Ice(loader) ?
ID: 5ea24b50-555f-5b97-9b30-67483e6cc0ae
STIX ID: report--5ea24b50-555f-5b97-9b30-67483e6cc0ae
Feed Name: Plausible Deniablility
Date Published: 2021-05-13
Date Updated: 2026-08-11
Author: {"name"=>"", "avatar"=>"/assets/images/avatar-round.svg", "bio"=>"Cyber Threat Intelligence. Allegedly.", "links"=>[{"label"=>"Twitter", "icon"=>"fab fa-fw fa-twitter-square", "url"=>"https://twitter.com/4rchib4ld"}, {"label"=>"GitHub", "icon"=>"fab fa-fw fa-github", "url"=>"https://github.com/4rchib4ld"}, {"label"=>"LinkedIn", "icon"=>"fab fa-fw fa-linkedin", "url"=>"https://www.linkedin.com/in/axel-z-9a9a38117/"}]}
Technical blog report on reversing and automating the unpacking of an IcedID packer ("Iceloader"): the author details how the packer loads two PE-section chunks, decodes/decrypts the payload using a hard-coded marker, uses emulation (Unicorn/Qiling) to run recovered code, created Yara rules to detect variants, and produced three automation modules (Python script, Karton module, mwcfg module) to extract IcedID configs; a retro-hunt also located the same packer used with Bazar samples, suggesting shared or sold tooling across campaigns.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.