#icedid

@1or3 very good question!

Since we haven't seen it much outside of laboratory conditions yet, and it still seems to be under development, there are no surefire way to detect it yourself yet. However, there are some precautions you can take to avoid becoming a victim of it:

- we know it spreads (currently) mainly from a botnet called Emotet. Having an antivirus software that is able to detect an Emotet infection should leave you safe for now.

- having a scriptblocker such as Noscript installed in your browser could maybe prevent IcedIDs ability to inject a fake page, although this is just a theory of mine, not verified.

- probably the best option (and this works for avoiding pretty much all banker trojans and other malware in general) requires a little bit of work but could be worth it if your computer has a little bit of extra power: setting up a virtual machine with a Linux distribution, and do all your sensitive information tasks from it. So far IcedID and all of the other most common banker trojans are not able to function at all in a Linux environment, and advanced malware in general avoids infecting virtual machines due to the fact it's what is commonly used by malware researchers to analyze malware, so it works as a double protection.

Upon booting up my daily work, one of the first things I do is log into my OpenCTI server and see what’s going on. This is generally an initial cursory look; very often nothing has changed from one day to the next on the dashboard.

But sometimes something new pops up. Today it was the ransomware loader known as Latrodectus, coming into the top ten most active malware for the last three months in 7th position. This in itself is not an unusual occurrence. There is always some variation in the top ten, although typically the top five remain the same, shuffling among themselves. And speaking of which, CobaltStrike is still in the top spot, with the number of incidents involving it increasing to the point where my graph has zoomed out to compensate for its activity. What caught my attention with Latrodectus is that it hasn’t been particularly active of late, having been initially reported on in November of 2023 and showing signs of diminished use by March of 2024.

So, why is it back? A simple search within the last month gave me my answer. Latrodectus has a new sibling.

I’ve talked before about how malware is classified into families. In this case, Latrodectus is considered a successor to IceID, a banking Trojan from at least 2017. The two share many overlaps in code and behavior, and are thought to be the work of the same threat actor, TA577. And now there is a third malware in the family: YiBackdoor.

This trio shows how classification into a family does not necessarily correspond to function. IcedID is a Trojan that collects login credentials among financial institutions using web injection to hide in legitimate site content. Latrodectus is a downloader carrying payloads of executable code that allow it to evade detection in sandboxes and maintain persistence in affected systems. YiBackdoor appears to serve as the vector – given its name as a backdoor – by which other malware is delivered into a device. What connects these three isn’t their function, it’s their similarities in source code, leading to the fairly confident supposition that they’re all the work of the same developer.

All three exhibit the same tree of actions to infiltrate a system or device, set themselves up for persistence and execute commands to collect data and/or transmit that data to a C2 server. Thus far YiBackdoor’s functionality appears to be limited by default. However, it can deploy commands to plugins to expand its capabilities. Which again tracks for backdoor behavior.

This trio of related malware is exemplary of how malware as a whole evolves both in function and evasion technique. As quickly as we at the security end of things catch and remediate infection, new vectors and attempts at anti-analysis are programmed in. But as threat actors persist, so do we. Your friendly neighborhood WISP will be keeping an eye out.

Researchers at Zscaler have uncovered YiBackdoor, a sophisticated backdoor that injects into processes, encrypts its plugins, and communicates with C2 servers using dynamically derived keys, showing clear code ties to IcedID and Latrodectus.

Source: Zscaler ThreatLabz

A Deep Dive Into IcedID Malware: Part II – Analysis of the Core IcedID Payload (Parent Process)

In part I of the blog, I demonstrated how to unpack the IcedID malware, hooking and process injection techniques used by IcedID, as well as how to execute the IcedID payload. In this part, let’s take a closer look at the core payload.

0x01 Overview Of The Payload

The following is the entry point of the payload. It first unhooks the function RtlExitUserProcess. The core function is implemented…

A Deep Dive Into IcedID Malware: Part I – Unpacking, Hooking and Process Injection

IcedID is a banking trojan which performs web injection on browsers and acts as proxy to inspect and manipulate traffic. It steals information, such as credentials, from victims. It then sends that stolen information to a remote server.

Recently, the FortiGuard Labs team started to investigate some IcedID samples. In this series of blogs, I will provide a detailed analysis of a new IcedID…

Geodo: la nueva campaña de Qakbot

Qakbot llega de la mano de Geodo Los investigadores descubrieron las botnets de Geodo utilizando una nueva campaña de spam para entregar muestras de malware Qakbot.

Cofense observó que las botnets distribuían malware no Geodo desde al menos el 28 de enero a través de esfuerzos de phishing cada vez más específicos. 

El ataque comienza cuando un usuario recibe un correo electrónico de suplantación…