Loading malware…
IcedID, also known as IceID and BokBot, is a Windows malware family best known as a banking trojan that evolved into a modular loader used widely in financially motivated intrusion chains. It has been associated with credential-focused crimeware activity and has also served as an entry-point malware for follow-on operations, including ransomware intrusions. Delivery has commonly relied on phishing emails carrying malicious Office documents with embedded macros, and the family has also been observed in campaigns using Excel add-in files as an execution vector.
IcedID uses staged loading and in-memory execution to deploy additional components while reducing forensic visibility. Reported variants decrypt embedded configuration data, including command-and-control information, and retrieve secondary payloads from remote infrastructure. Multiple analyses describe loader and downloader components that unpack or decrypt code from resources, allocate memory for execution, and use process-injection-style techniques. Some variants employ anti-analysis and defense-evasion measures such as uncommon API usage, obfuscated or encrypted payload storage, and removal of in-memory PE header artifacts.
A notable IcedID technique is steganographic payload delivery through PNG files. In these variants, the malware checks for or downloads a PNG payload, parses the PNG structure to locate image data chunks, extracts an embedded RC4 key and encrypted blob, decrypts hidden shellcode, and executes it in memory. Older variants reportedly stored encrypted code in resource sections, while newer variants used compressed modules and dedicated PNG-processing routines.
Operational reporting also links IcedID to post-compromise activity including reconnaissance, scheduled-task persistence, use of remote execution and administrative tooling, and support for broader intrusion workflows that can culminate in ransomware deployment by downstream actors. The malware primarily targets Windows environments and has been observed in financially motivated campaigns affecting enterprise users and organizations.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
18 distinct techniques documented for this family, organized by ATT&CK tactic.
In April, we detected that Ursnif was being delivered via malicious emails along with the IceID banking trojan.
The most common initial infection vectors used are spear phishing and RDP (Remote Desktop Protocol) services. Phishing emails work either through malicious attachments, such as Word documents with an embedded macro that can be used to drop/download BazarLoader, Trickbot, IceID trojans
this is a simple script to automatically extract the encrypted shellcode of iceid that are place in its PNG payload (steganography).
Next it will decrypt the encrypted shellcode and IceID downloader from its RSRC section. This is done by finding specific resource name, locate its address location and its resource entry size to the file...
The first 8 bytes of the encrypted data section is the RC4 key and the rest is the encrypted data.
ICEID Loader changes its Crypter to execute its main module in memory.
ANTI-Memory Forensic: Also I notice that upon loading the ICEID downloader to the memory to execute it, the loader removed the DOS header as a common anti-forensic technique.
the iceid variant that supported by this tools has same png payload structure that can be parse within the png file itself including the rc4 decryption (8 bytes), encrypted data, size of encrypted data
One Interesting code of this IceID stager/loader is that it tries to load the 'runas.exe' using LoadLibraryExA. Currrently I don't know what are the other purpose of this loading aside from evading or bypassing emulation tools or engine.
it will check the existence of the PNG file in %appdata%<randomname>/
it will check the existence of the PNG file in %appdata%<randomname>/
14 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Banking trojan used as an initial infection via phishing/macro documents; used for discovery, credential dumping, persistence (scheduled tasks), and leveraging tools for lateral movement; associated with ransomware deployment in some intrusions.
Malware family mentioned as using XLL files as an infection vector.
Banking trojan/loader mentioned as using XLL files as an infection vector (no further technical detail provided in the content).
Trojan delivered through phishing attachments as part of the initial access chain tied to Conti operations.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.