A new malware loader recently discovered in January 2022 has been detailed in a report by Symantec researchers. The trojan, named “Verblecon,” has been described as “complex and powerful” yet the unknown threat actors utilizing the malware appear to be unsophisticated, conducting “low-reward” attacks. This led the researchers to believe the threat actors do not realize the potential of the malware they created. The stand-out feature of the malware is its use of polymorphic techniques to evade detection. By changing the encryption and obfuscation techniques while creating the malicious executable, it appears to be a different executable every time it is downloaded. The base of the malware appears to be a publicly available HTTP bot called “LiteHTTP” that was originally posted to GitHub in 2015. Before Verblecon’s payload is executed, the loader checks for common virtualization software as well as anti-virus running on the machine by searching for files and processes associated with these applications. While the malware loader is in its infancy, researchers have found samples installing cryptocurrency mining software on victim machines as well as a Discord token stealing malware to further spread the malicious software. Other reports have connected similar domain names used by this botnet to the Orcus remote access trojan, though the credibility of the link is not certain. CTIX analysts will continue to monitor the progress of this malware and will update if the loader is used in more sophisticated attacks.