{
  "family": "whiteice",
  "sample_count": 1,
  "category": "ransomware",
  "description": "<h3>Executive Summary</h3>\nWhiteIce is a malicious downloader Trojan engineered to stealthily infiltrate a target system, establish a hidden foothold, and subsequently download and execute secondary malware payloads. It acts as a critical intermediary in complex infection chains, often paving the way for highly destructive threats like ransomware or banking trojans.\n\n<h3>Infection Vector and Execution Flow</h3>\nWhiteIce is typically distributed via targeted spear-phishing campaigns. The emails utilize socially engineered lures containing malicious macro-enabled Microsoft Office documents, or ZIP archives containing heavily obfuscated scripts.\n\nUpon execution of the initial lure, WhiteIce is deployed onto the system. Its primary operational phases include:\n<ul>\n<li><strong>Reconnaissance and Evasion:</strong> WhiteIce immediately checks its environment to ensure it is not running within a malware analysis sandbox or virtual machine. It may also check the system locale to avoid infecting targets in specific geographic regions.</li>\n<li><strong>C2 Communication:</strong> The Trojan reaches out to a hardcoded or dynamically generated command-and-control (C2) server. It transmits a basic fingerprint of the infected machine (OS version, installed antivirus) to the attacker.</li>\n<li><strong>Payload Delivery:</strong> Based on the transmitted fingerprint, the C2 server instructs WhiteIce to download a specific secondary payload. This payload is often injected directly into the memory of a legitimate process (like `explorer.exe`) to evade file-based detection.</li>\n</ul>\n\n<h3>Security Implications</h3>\nA WhiteIce infection indicates a severe perimeter breach. While the WhiteIce executable itself may not directly steal data, its successful execution guarantees that a secondary, potentially catastrophic payload is either imminent or already active on the network.\n\n<h3>Eradication and Incident Response</h3>\n<ul>\n<li><strong>Advanced EDR Detection:</strong> Configure EDR platforms to monitor for anomalous parent-child process relationships, specifically office applications spawning command shells (`cmd.exe`) or PowerShell, which is indicative of a WhiteIce downloader script executing.</li>\n<li><strong>Network Isolation:</strong> Immediately isolate the affected endpoint to interrupt the WhiteIce C2 communication and prevent the download of the secondary payload.</li>\n<li><strong>Comprehensive Sweeps:</strong> A standard antivirus scan is insufficient. Perform a deep forensic sweep to locate the WhiteIce persistence mechanisms (registry keys) and identify/remove the specific secondary payload it downloaded.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Downloader.WhiteIce",
    "Trojan.WhiteIce",
    "Win32/WhiteIce"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1105",
    "T1059",
    "T1055.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-01T16:13:06Z",
  "type": "Downloader",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}