Rewterz Threat Alert – IcedID banking Trojan

Rewterz Threat Advisory – CVE-2022-41123 – Microsoft Exchange Server Vulnerability

November 10, 2022

Rewterz Threat Alert – An Emerging Heodo Malware – Active IOCs

November 10, 2022

Rewterz Threat Alert – IcedID banking Trojan – Active IOCs

Severity

High

Analysis Summary

IcedID, aka BokBot – a banking trojan – first appeared in 2017. The threat actor behind IcedID is Lunar Spider. The main purpose of this trojan is to steal financial information but aside from this, it is also a passage for a RAT. Initially, it was delivered as a later-stage payload from multiple threats including Emotet, TrickBot, and Hancitor. Recently, it is observed that its threat actors are using several new techniques to avoid detection by the sandbox and endpoint security. This trojan has capabilities similar to Zeus, Dridex, and Gozi (financial threats). IcedID can download different additional modules and a configuration file from C2. It performs its task of stealing information by deploying a man-in-the-browser attack which assists in gaining banking credentials.

Impact

Financial Loss
Exposure of Sensitive Data

Indicators of Compromise

Domain Name

anisamnatyrel[.]com

IP

167[.]172[.]39[.]160

MD5

8c3b0e81e3af9ee28287861769359607

SHA-256

0948395f8da4dd441bf62d935632a8d599a853db84771a12387e82672a2d3575

SHA-1

b8708e760924c366d8e3f7a076edd68fcd89e19b

Remediation

Block all threat indicators at their respective controls.
Search for IOCs in your environment.