Loading malware…
IcedID, also known as BokBot, is a Windows malware family that originated as a banking trojan and evolved into a modular malware platform used for credential theft, post-compromise access, and delivery of additional payloads. It has been associated with financially motivated intrusion activity and has been linked in public reporting to follow-on deployment of tools and malware such as Cobalt Strike, VNC-based backdoors, and ransomware operations. Public reporting has also associated IcedID activity with UNC2198, and the malware has appeared in broader cybercrime delivery ecosystems involving operators such as TA578 and malware distributors such as Emotet and Gootloader.
IcedID is commonly delivered through phishing emails carrying malicious attachments, including Word documents with embedded macros, and has also been observed as a second-stage payload delivered through SEO-poisoning and compromised-site traffic associated with Gootloader. Historical reporting further notes delivery by Emotet. Once executed, IcedID employs anti-analysis and anti-virtualization checks, gathers host information, and communicates with command-and-control infrastructure using HTTP requests that embed victim profiling data in cookie fields.
On infected systems, IcedID has demonstrated multiple persistence and evasion mechanisms. Reported techniques include creation of scheduled tasks, establishment of Registry Run key persistence, abuse of signed Windows binaries such as msiexec.exe for stealthier execution, and remote process injection using native APIs. Public analyses describe injection into suspended or remote processes, including process hollowing and APC-style execution, to conceal malicious activity within legitimate Windows processes. IcedID has also been observed identifying installed antivirus products on compromised hosts.
The malware’s functionality extends beyond banking theft. Publicly documented variants and related components include loader, injector, core bot, and VNC server capabilities. Operational reporting has tied IcedID infections to BackConnect activity, Anubis VNC or Keyhole VNC access, and subsequent Cobalt Strike deployment, indicating its role as both an infostealing malware family and an access-enablement platform for broader intrusion chains. It primarily targets Windows environments, including enterprise domain-joined systems, and has been used across financially motivated campaigns affecting a wide range of organizations.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Kevin Beaumont reported on this conversation hijacking technique back in November 2021 being used to distribute Qakbot. Through the investigation, he confirmed that the Microsoft Exchange servers where the emails originated from had evidence of being exploited by ProxyShell... The majority of the originating Exchange servers we have observed appear to also be unpatched and publicly exposed, making the ProxyShell vector a good theory.
In November 2021, a Trend Micro report described a wave of attacks using ProxyShell and ProxyLogon vulnerabilities in exposed Microsoft Exchange servers to hijack internal email reply-chains and spread malware-laced documents. | The distribution of the IcedID malware has seen a spike recently due to a new campaign that hijacks existing email conversation threads and injects malicious payloads that are hard to spot. IcedID is a modular banking trojan first spotted back in 2017, used mainly to deploy second-stage malware such as other loaders or ransomware.
the seller offered two types of weaponized Microsoft Office documents (maldocs) to users: one that exploits a known vulnerability in Microsoft Office (CVE-2017-8570) and another that uses a malicious macro.
Windows Office Product Spawned Uncommon Process ... CVE-2023-21716 Word RTF Heap Corruption, CVE-2023-36884 Office and Windows HTML RCE Vulnerability ...
30 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
2022-06-28 (TUESDAY) - TA578 ICEDID (BOKBOT) WITH BACKCONNECT, ANUBIS VNC AND COBALT STRIKE
"1580103814": "APT27/Qbot/IcedID/DarkSide/Conti/Hancitor/WizardSpider - Stats uniques -> ips/hostnames: 85 publickeys: 39"
"1580103814": "APT27/Qbot/IcedID/DarkSide/Conti/Hancitor/WizardSpider - Stats uniques -> ips/hostnames: 85 publickeys: 39"
In 2017 it was the first group to deliver the IcedID (Trojan.IcedID) banking Trojan.
IcedID – a botnet loader known to arise from malicious documents and often leading to Cobalt Strike or other backdoors that position threat actors for ransomware deployment.
IcedID – a botnet loader known to arise from malicious documents and often leading to Cobalt Strike or other backdoors that position threat actors for ransomware deployment.
29 distinct techniques documented for this family, organized by ATT&CK tactic.
They compel the victims to click on malicious links and install a malicious executable through social engineering and phishing. | Threat actors like affiliates of ransomware groups have started to utilize this technique to infect targets across the world. They recruit callers who work on phishing campaigns, called the “Callback phishing” technique.
The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.
λ python iceid_png_shellcode_extractor.py -i buuzac.png
At the end of the document the scripting changes languages from JavaScript to VBscript ... <script language='vbscript'> Call rtxVideo(cardComputerMonitor) Call rtxVideo(rtxI7Super) </script> | The output from oledump.py indicates streams 8 and 15 contain macro content... Sub Document_Open() hny End Sub ... ActiveDocument.SaveAs2 FileName := processorI9, FileFormat := 2 ThisDocument.srn1 processorI9
The content is a MITRE ATT&CK-style listing of many malware families and threat groups using Windows/native OS APIs for execution, injection, discovery, anti-debugging, and other actions, ending with 'NtCreateProcess' and 'fork()'.
The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.
The first main encoded payload is written to the registry key under HKEY_CURRENT_USER\SOFTWARE\Microsoft\username\ via Wscript process using RegWrite Method.
ADVSTORESHELL achieves persistence by adding itself to the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Registry key... APT28 has deployed malware that has copied itself to the startup directory for persistence... FIN7 malware has created Registry Run and RunOnce keys to establish persistence, and has also added items to the Startup folder.
The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.
IcedID can inject itself into a suspended msiexec.exe process to send beacons to C2 while appearing as a normal msi application.
Agent Tesla has used process hollowing to create and manipulate processes through sections of unmapped memory by reallocating that space with its malicious code. APT-C-36 has used process hollowing to execute malware in the memory of legitimate processes. Astaroth can create a new process in a suspended state from a targeted legitimate process in order to unmap its memory and replace it with malicious code.
ADVSTORESHELL achieves persistence by adding itself to the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Registry key... APT28 has deployed malware that has copied itself to the startup directory for persistence... FIN7 malware has created Registry Run and RunOnce keys to establish persistence, and has also added items to the Startup folder.
crypters, which are also referred to as loaders or packers, are applications designed to encrypt and obfuscate malware to evade detection by antivirus (AV) scanners and hinder analysis.
this is a simple script to automatically extract the encrypted shellcode of iceid that are place in its PNG payload (steganography).
IcedID can inject itself into a suspended msiexec.exe process to send beacons to C2 while appearing as a normal msi application.
Agent Tesla has used process hollowing to create and manipulate processes through sections of unmapped memory by reallocating that space with its malicious code. APT-C-36 has used process hollowing to execute malware in the memory of legitimate processes. Astaroth can create a new process in a suspended state from a targeted legitimate process in order to unmap its memory and replace it with malicious code.
the iceid variant that supported by this tools has same png payload structure that can be parse within the png file itself including the rc4 decryption (8 bytes), encrypted data, size of encrypted data
_gid – gets the network adapter information via GetAdaptersInfo
_u – retrieves the computer name and username via GetComputerNameExW and GetUserNameW functions
The content repeatedly describes malware and threat actors collecting OS version, computer name, architecture, CPU, memory, disk, language, and other host details; examples include use of commands such as ver, systeminfo, hostname, uname -m, sw_vers -productVersion, and fsutil.
Moreover, the adoption of SSL/TLS in malware is not restricted to the HTTPS protocol; other protocols, including SMTP and custom TCP protocols, were also found using SSL/TLS. | Over the last six years there has been an increased shift by malware authors to secure their C&C communications using the SSL/TLS protocol to stymie detection and blend in with normal traffic.
IcedID will collect user and host information, and send it through specific parameters in the Cookie header. | The next function is the configuration and execution of the connection with the C&C servers... take the code flow to the WinHTTP standard API execution function, to execute a connection through the HTTP protocol.
At 15:31:08 UTC, the host at 10.4.19[.]136 generated an HTTP GET request to hxxp://80.77.25[.]175/main.php ... The HTTP response headers in Figure 4 show a 302 code, redirecting traffic to the following URL: hxxps://firebasestorage.googleapis[.]com/.../Scan_Inv.zip | This reveals HTTPS traffic to firebasestorage.googleapis[.]com shortly after traffic to the initial URL ... The TCP stream reveals 273 KB of data sent from the server to the Windows host ... the ZIP archive ... contains a file named Scan_Inv.exe. This Windows executable file is an IcedID installer.
The C2 activity can lead to BackConnect traffic, Cobalt Strike and Virtual Network Computing (VNC) activity ... However, this pcap does not contain any indicators of Cobalt Strike. | The C2 activity can lead to BackConnect traffic, Cobalt Strike and Virtual Network Computing (VNC) activity. | Undetected IcedID infections lead to follow-up activity like BackConnect traffic ... Previous IcedID infections also reveal this threat can generate VNC traffic over the same IP address used by BackConnect traffic.
1,268 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A banking trojan and malware dropper spread primarily through phishing emails with malicious Office documents. In this campaign it used benign-looking macros that extracted obfuscated JavaScript from the document, dropped and executed an HTA via mshta.exe, downloaded a DLL disguised as a .jpg file, and then stole and exfiltrated host and credential-related data to C2 infrastructure.
Used in campaigns that stealthily load malicious DLLs via Regsvr32, enabling arbitrary code execution, additional payload download, and further system compromise.
Browser-hooking banking trojan associated with remote thread creation into browser processes to steal sensitive information such as banking details.
A malware payload delivered in BumbleBee-related campaigns; also mentioned as malware distributed by IABs in similar infection chains.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.