Malware
CLOUDBURST
aka NickelLoader
CLOUDBURST aka NickelLoader is an HTTP(S) downloader.
CLOUDBURST, also known as NickelLoader, is a Windows malware family operated by Lazarus Group.
Background
CLOUDBURST, also tracked as NickelLoader, is an HTTP(S) downloader.
It supports four basic commands, each five letters long, such as abcde, avdrq, gabnc and dcrqv (or alternatively eknag, eacec, hjmwk, wohnp). Its primary job is to load a buffer it receives, either as a DLL through the MemoryModule implementation or as shellcode.
Network traffic is encrypted and decrypted with AES. The malware typically reports the computer name, product name, and a list of running processes back to its C&C server, and its initial HTTP POST requests usually carry two hardcoded parameter names: gametype and type (or alternatively type and code).
The CLOUDBURST payload masquerades as mscoree.dll and is side-loaded by the legitimate Windows binary PresentationHost.exe using the -embeddingObject argument. It is delivered either as a trojanized Notepad++ plugin project (commonly FingerText by erinata) or as a standalone DLL dropped by a loader that is itself a trojanized plugin project (commonly NppyPlugin by Jari Pennanen).
This malware featured in Operation DreamJob intrusions during Q2-Q3 2022 against an aerospace company and a network running Microsoft Intune software.
Source: Malpedia (Fraunhofer FKIE).