Technical Analysis of Files Used in 3CX Desktop App Malware Campaign

Trojanized, signed versions of the 3CX Desktop App delivered a multi-stage infection (ffmpeg.dll -> d3dcompiler_47.dll -> downloaded .ico files -> final payload) that decrypts C2 URLs and installs a previously unseen info stealer named ICONIC on Windows and macOS; the stealer exfiltrates browser history and potential sensitive URL data. The report provides detailed technical analysis, IoCs (hashes and URLs), and detection artifacts (YARA) and notes observations from CrowdStrike and Volexity.