ICEDID, also known as BokBot, is a modular banking malware designed to steal financial information. It is first discovered around 2017 and observed in the wild being downloaded as a second stage payload from EMOTET campaigns. It is capable of propagation over the network, monitor activities from the infected system and exfiltration of data. It conducts a man-in-the-browser attack such as web-injection, proxy setup and redirection. It continuously evolves to increase persistence and detection evasion.

In recent malspam campaigns, a cybercriminal threat group called Shathak or TA551 distributed the malware. The malspam has a password protected ZIP attachment that appears to contain a request document. Extracted from the ZIP file is a Word document containing malicious macros. It uses social engineering attempt to trick the user to enable the macros. It will download the ICEDID loader as a DLL file with a different extension such as .tmp or .pdf. It connects to the C&C server to download a PNG file that contains encrypted data of the ICEDID malware. The loader will decrypt the data and inject the malware in an instance of svchost.exe.

Behaviour

• Has anti-debugging and anti-VM checks
• Hides encrypted payload in PNG files (steganography)
• Modification of code injection tactics
• Stealth and fileless operation

Capabilities

• Information Theft
• Propagation

Impact

• Financial loss - steals banking information
• Violation of user privacy - gathers user credentials on various applications
• Regional Impact (October 1, 2020 - November 17, 2020)

  REGION	EUROPE	JAPAN	AMERICAS		APAC	N-ASIA	AMEA
  CUSTOMER CASE COUNT	10	131	2		-	-	-
  REGION	EMEA	JAPAN	NABU	LAR	APAC
  SPN VSAPI FEEDBACK	507	413	608	4	141

Additional Threat Reference Information

• Threat Encyclopedia: Trojan.W97M.ICEDID.FAID
• Security News: IcedID Banking Trojan Targets US Financial Institutions

Sample Spam

Sample Attachment

Infection Chain

MITRE ATT&CK Matrix