Rewterz Threat Alert – IcedID Banking Trojan aka BokBot – Active IOCs

January 19, 2023

Severity

Medium

Analysis Summary

IcedID, aka BokBot – a banking trojan – first appeared in 2017. The threat actor behind IcedID is Lunar Spider. IcedID malware is known for its sophisticated tactics, techniques, and procedures (TTPs) that allow it to evade detection and steal sensitive information from its victims. It is typically delivered via phishing emails, but it can also be delivered via exploit kits and other methods.

Once the malware is installed on a system, it begins to gather information about the infected computer and the user. This information is used to tailor the malware’s attacks to the specific victim. IcedID malware is known to use several methods to steal sensitive information, including keylogging, web injections, and form-grabbing.

The malware is also able to download additional malware and open a backdoor for the attackers to gain access to the infected system. This allows the attackers to gain a foothold on the victim’s network and steal sensitive information and move laterally to other systems.

The malware is also known to use a technique called “living off the land” to evade detection and make it harder for security software to detect and remove it. This includes using legitimate tools and processes that are present on the system and disguising the malware’s code to look like legitimate software.

IcedID malware is a serious threat to individuals and organizations alike, and it is important to be vigilant and take the necessary steps to protect yourself and your organization from this type of malware.

Impact

Financial Loss
Exposure to Sensitive Data

Indicators of Compromise

MD5

5f8a9cb690464151bb443ed4740a3c27
2142f4dca9dc32d3d3ddb120c97ab879
55fabc6b83edfba269d697a7973cb837
823e6ec59140043e4e850e4016018a77
478057d87e40aef6a71453c27eb77649

SHA-256

c2e3097e2de547d70f1d4543b51fdb0c016a066646e7d51b74ca4f29c69f5a85
778f1cbd036de33d6e6eb5b0face18c276732e365111bdfae447b30ccfebf8c5
b1ef43379c1af0ed2bbc2dd710df65a550b3b80cce1b734438e20c64f1d5a42e
bd67e49c2ca15156c54956655928723063eca5b4d90ae22dd6ce1029ba596b35
7fa1fbd2c625269c408d515a7f7a2289e19f5f5d3cef46a96300212071215649

SHA-1

e467d01dd6810da100fb2b96fc30f2d33a205602
ebf2a4a2d0340d1fd6408dc8b47e8dfcc2e4cc81
13ca26df9e0f7fb04596cbf52aa542a54d0a2e10
f12d6a892debcfeec812108ea8913eb6d09bbdc4
6042bd527323c6288e6c9be94a125c9c02f6011e

Remediation

Block all threat indicators at your respective controls.
Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls
Emails from unknown senders should always be treated with caution.
Never trust or open ” links and attachments received from unknown sources/senders.
Patch and upgrade any platforms and software timely and make it into a standard security policy. Prioritize patching known exploited vulnerabilities and zero-days.
Enable antivirus and anti-malware software and update signature definitions in a timely manner. Using multi-layered protection is necessary to secure vulnerable assets