Malware
Lorem Ipsum
According to BlueVoyant, Lorem Ipsum is a multi-stage malware family written in PowerShell for its loader components, with later stages transitioning to shellcode and DLL-based payloads.
Lorem Ipsum is a Windows malware family.
Background
BlueVoyant reports that Lorem Ipsum is a multi-stage malware family whose loader components are written in PowerShell, with the later stages shifting to shellcode and DLL-based payloads. Its loader strings together several PowerShell stages that AES-decrypt the embedded payloads, then gzip-decompress them and load them reflectively in memory; more recent builds add substitution-cipher decoding and XOR-encrypted shellcode stubs. It maintains persistence through Windows registry Run keys and has progressed to DLL sideloading, in which a legitimate executable loads a malicious DLL that decodes embedded ciphertext to start the main loader. C2 communication is hidden inside JFIF image files, with extra data tacked on past the image's end so that two-way traffic masquerades as ordinary images.
Source: Malpedia (Fraunhofer FKIE).