PHOTOFORK

PHOTOFORK is a Windows malware family.

Background

PHOTOFORK is a downloader derived from a reworked GZIPLOADER. First seen in February 2023, it was spread by TA581 together with an unattributed threat cluster that provided initial access. Unlike earlier versions, its configuration file is no longer protected by a basic XOR scheme with a 64-byte key; instead it employs a custom algorithm formerly used by the Standard core loader. That routine decrypts DLL strings needed later to resolve handles to the required DLLs, breaking the data into DWORDs and XORing each against a random key. PHOTOFORK's purpose mirrors GZIPLOADER: to drop an encrypted bot and a forked core DLL loader that maps the Forked ICEDID bot into memory through a custom PE format.

Source: Malpedia (Fraunhofer FKIE).