Disclosing The Intricacies Of DiceLoader Malware

DiceLoader also known as Lizar and Tirion is loader malware associated with the FIN7 threat group. It serves to load additional malicious software including remote access trojans. FIN7 active since 2015 operates like a corporate business with Russian-speaking members concealing its activities behind front companies. It targets multiple sectors including retail and hospitality across regions such as the United States the United Kingdom Australia and France. DiceLoader a small-sized malware in FIN7s arsenal uses various internal structures to hinder analysis and is dropped by a PowerShell script. Its operations involve obfuscation reflective code loading dynamic API resolution and non-standard encoding.