Loading malware…
IcedID, also known as BokBot, is a modular Windows banking trojan first identified in 2017. It steals login credentials, banking information, browser cookies, and other personal information, and has evolved into a loader and initial-access tool used in ransomware operations. Its secondary payloads include Cobalt Strike and remote-access components. IcedID infections have provided access for Conti ransomware operations, and Black Basta has used it as a loader. Distributors associated with IcedID include TA578, Storm-0324, and Wizard Spider.
IcedID is commonly delivered through phishing and malicious spam, including malicious Office documents and ZIP archives containing ISO images and Windows shortcuts. It has also been deployed as a follow-on payload by Emotet, Bazar, Raspberry Robin, and Latrodectus. Some distribution campaigns use nested ZIP, ISO, and polyglot compiled-help files: opening the help document executes embedded JavaScript and invokes the Windows HTA handler to retrieve the malware. These chains exploit differences in file-format interpretation to conceal executable content from security inspection.
Its multistage architecture includes a loader and an encrypted core payload that can be loaded into memory using a custom structure rather than a conventional PE header. IcedID supports process injection, including process hollowing, and establishes persistence through scheduled tasks or a Registry Run mechanism. Modules provide browser-traffic proxying and credential interception, cookie theft, command and PowerShell execution, shellcode execution, file access, process enumeration, and system, security-software, network, and Active Directory reconnaissance. Analyzed variants also support reverse-shell and VNC functionality.
IcedID uses encrypted or encoded components, packing, virtualization checks, and other anti-analysis techniques. Its command-and-control communications use web protocols and TLS certificate pinning to validate servers before communication. The combination of information theft, remote execution, and secondary-payload delivery makes it both a financial-theft threat and a foothold for subsequent enterprise compromise.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Kevin Beaumont reported on this conversation hijacking technique back in November 2021 being used to distribute Qakbot. Through the investigation, he confirmed that the Microsoft Exchange servers where the emails originated from had evidence of being exploited by ProxyShell... The majority of the originating Exchange servers we have observed appear to also be unpatched and publicly exposed, making the ProxyShell vector a good theory.
In November 2021, a Trend Micro report described a wave of attacks using ProxyShell and ProxyLogon vulnerabilities in exposed Microsoft Exchange servers to hijack internal email reply-chains and spread malware-laced documents. | The distribution of the IcedID malware has seen a spike recently due to a new campaign that hijacks existing email conversation threads and injects malicious payloads that are hard to spot. IcedID is a modular banking trojan first spotted back in 2017, used mainly to deploy second-stage malware such as other loaders or ransomware.
the seller offered two types of weaponized Microsoft Office documents (maldocs) to users: one that exploits a known vulnerability in Microsoft Office (CVE-2017-8570) and another that uses a malicious macro.
Windows Office Product Spawned Uncommon Process ... CVE-2023-21716 Word RTF Heap Corruption, CVE-2023-36884 Office and Windows HTML RCE Vulnerability ...
31 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
IcedID, also known as BokBot, is a malware family that first appeared in 2017 as a banking trojan and later became a tool for selling initial access to ransomware affiliates.
IcedID has been delivered via phishing e-mails with malicious attachments.
“Prior to this threat, Storm-0324 had the following range of payload distribution: ... IcedID.”
“IcedID:” Loader malware used for command-and-control (C2) and delivering advanced malware like ransomware to compromised systems.
TA578 is a threat actor that has used contact forms and email to initiate communications with victims and to distribute malware including Latrodectus, IcedID, and Bumblebee.
"1580103814": "APT27/Qbot/IcedID/DarkSide/Conti/Hancitor/WizardSpider - Stats uniques -> ips/hostnames: 85 publickeys: 39"
32 distinct techniques documented for this family, organized by ATT&CK tactic.
1,273 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Originally stole financial information and subsequently became an initial-access tool for ransomware operations, including Conti. Targeted by Operation Endgame in May 2024.
Infostealer distributed through a nested attachment chain designed to evade detection: ZIP archive, ISO disk image, and CHM file that is handled by mshta to download the primary payload.
Infostealer distributed through a nested polyglot attachment chain: ZIP archive to ISO image to a CHM file that is also processed as an mshta application, which downloads the primary payload.
Listed as a payload historically distributed by Storm-0324. The article provides no further description of its functionality or role.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.