Rewterz Threat Alert – IcedID Banking Trojan aka BokBot – Active IOCs

Severity

Medium

Analysis Summary

IcedID, aka BokBot – a banking trojan – first appeared in 2017. The threat actor behind IcedID is Lunar Spider. IcedID malware is known for its sophisticated tactics, techniques, and procedures (TTPs) that allow it to evade detection and steal sensitive information from its victims. It is typically delivered via phishing emails, but it can also be delivered via exploit kits and other methods.

Once the malware is installed on a system, it begins to gather information about the infected computer and the user. This information is used to tailor the malware’s attacks to the specific victim. IcedID malware is known to use several methods to steal sensitive information, including keylogging, web injections, and form-grabbing.

The malware is also able to download additional malware and open a backdoor for the attackers to gain access to the infected system. This allows the attackers to gain a foothold on the victim’s network and steal sensitive information and move laterally to other systems.

The malware is also known to use a technique called “living off the land” to evade detection and make it harder for security software to detect and remove it. This includes using legitimate tools and processes that are present on the system and disguising the malware’s code to look like legitimate software.

IcedID malware is a serious threat to individuals and organizations alike, and it is important to be vigilant and take the necessary steps to protect yourself and your organization from this type of malware.

Impact

• Financial Loss
• Exposure to Sensitive Data

Indicators of Compromise

MD5

• 453846f0c568115c55f327758f76dee4
• 9a27f10ab1f551a3c29ad199df18f1e9
• 524954b01e5f6762c6ebe5bfba7126b1
• 39c18b622b44efe2b30df7245f0fa39d
• f2f858e7763a1725fffe711267d2af33
• 04775a034162eee520609b730a13bcdc
• fd7b22da6d083c35821ae79270d9e83d
• b940f9dc5e1f90b9366af62399d9b147

SHA-256

• 33cf7da7038defe4719b662e2e658b6c59ad592e427b9bd45f813369074a6996
• 560155afc04005bfd76a1148b42575fefcb52ed5d53e19fb30296475bf30c9b1
• 20258d38e142bb349a5f5446f0152fcc3a9402d36094f3e59e69f64496636dad
• 90a39276d80268d85cd067a491abb2271177dfa329089c9759d0cc4595f6d05a
• 6aabd487332f68b330519fb20dbdf73d36559d7931b5fc9d5c536ce52b423c0f
• 8ace5462fafb950876b4315c580eb13bf1018a1815abf07c6efda8434943cc54
• a5124f400e74fcbc68fa4f6ce7af9379bdb7a3bdcc54da85f4700ac6ef499f94
• 221e906b73db3dd177f65eba9310efeb2921f512d1eb67d516d8036b4193344e

SHA-1

• bddae5a3b2ba0c38822acdf2aad5945d3621c9bf
• 47daa487cdc181dcecce23fe0fbd8c9f94cea5d6
• dfe5f0440b02c9603f078a8eefd6a9cfc5ff9381
• a3497061ae436c74fe59fb59992afec4507f633e
• d22e752967cf915324807ad6d4a973ddb7f37449
• 9e01a74aab0362618fe6ff67ae1e83dcfe5d33d4
• 0e4c632bb51f3090f77eb541ead05fe770a23da4
• ed6367f231ae4c810342e3f31ff7f57738049469

URL

• https://aprettopizza.world/live/
• https://peermangoz.me/live/
• https://nimeklroboti.info/live/
• https://bossajazzbrasil.com/iii/
• http://162.55.217.30/gRMS/715.dat

Remediation

• Block all threat indicators at your respective controls.
• Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls
• Emails from unknown senders should always be treated with caution.
• Never trust or open ” links and attachments received from unknown sources/senders.
• Patch and upgrade any platforms and software timely and make it into a standard security policy. Prioritize patching known exploited vulnerabilities and zero-days.
• Enable antivirus and anti-malware software and update signature definitions in a timely manner. Using multi-layered protection is necessary to secure vulnerable assets.