IcedID Trojan
IcedID, also known as Bokbot, is new modular trojan malware that is delivered by the Emotet trojan to target financial and telecommunications organisations. It also has the ability to propagate over networks and infect terminal servers.
Summary
IcedID, also known as Bokbot, is new modular trojan malware that is delivered by the Emotet trojan to target financial and telecommunications organisations. It also has the ability to propagate over networks and infect terminal servers.
Affected platforms
The following platforms are known to be affected:
Threat details
Introduction
First appearing in September 2017, IcedID does not borrow code from other malware such as Zeus or Dridex but already has comparable features to these more prominent trojans. This indicates its creators are highly experienced and are likely to add new features to the malware in the future. It is deployed using the Emotet trojan as a dropper and requires a reboot to initiate installation, possibly to avoid sandboxes that do not emulate rebooting. Once installed it sets up a local proxy (127.0.0.1 port 41957) to collect information before sending to four command and control (C2) servers using Secure Sockets Layer (SSL). IcedID can also launch redirection attacks using a sophisticated scheme, including using the bank’s correct URL and SSL certificate, to collect user’s banking details.
IcedID has the capability to propagate across a network using Lightweight Directory Access Protocol (LDAP) to find new users. It has also been shown to be able to infect terminal servers, before infecting other endpoints through these.
Threat updates
| Date | Update |
|---|---|
| 12 Apr 2018 |
Emotet campaign delivering IcedID
A new Emotet campaign indicates IcedID is now being distributed alongside the Ursnif banking trojan as well as a Bytecoin cryptocurrency miner. |
Remediation advice
To prevent and detect a trojan infection
To prevent and detect an infection, NHS Digital advises that:
- Secure configurations are applied to all devices.
- Security updates are applied at the earliest opportunity.
- Tamper protection settings in security products are enabled where available.
- Obsolete platforms are segregated from the rest of the network.
- IT usage policies are reinforced by regular training to ensure all users know not to open unsolicited links or attachments.
- Multi-factor authentication (MFA) and lockout policies are used where practicable, especially for administrative accounts.
- Administrative accounts are only used for necessary purposes.
- Remote administration services use strongly encrypted protocols and only accept connections from authorised users or locations.
- Systems are continuously monitored, and unusual activity is investigated, so that a compromise of the network can be detected as early as possible.
Please note that NCSC maintains guidance for securely configuring a wide range of end user device (EUD) platforms. For further details refer to their end user device security guidance pages.
n, ensure that:
Indicators of compromise
Last edited: 11 January 2022 11:36 am