IcedID (Bokbot) — Paketli Banking Trojan, Modular Loader, Cobalt Strike Yukleme Platformu | Kritik

Manuel Statik Analiz (LLM Okumali) — IcedID (Bokbot) | Tehdit: KRITIK

Datei Kimligi

SHA256	`c7441ea5c8a42ce0a3afa24991c8a7f328434d2eba9c3d2a2fc26543c9288f9a`
Größe	405.504 byte
String Sayisi	2.067

Analiz Bulgulari

Bu IcedID ornegi agir sekilde paketlenmistir. Cleartext C2 adresi, URL veya email IOC bulunamadi. IcedID, C2 IP listesini sifrelenmis blob icerisinde saklar ve runtime'da cozumler.

IcedID Architektursi

Birinci Asama: Paketli loader — anti-analiz ve sandbox kacis teknikleri
Ikinci Asama: IcedID core DLL — bellekte sifresiz, diskte sifrelenmis
C2 Haberlesme: HTTPS, encrypted C2 list
Kalicilik: Zamanlanmis gorev veya COM hijacking

IcedID Downstream Payload'lar

Payload	Amac
Cobalt Strike Beacon	Lateral movement, enterprise penetrasyonu
Ransomware	Conti, REvil, Quantum yayilimi
Credential Harvester	Domain credential theft
Network Reconnaissance	AD enumeration

IcedID Hakkinda

IcedID (Bokbot), 2017 yilinda ortaya cikan banking trojan'dan gelismis enterprise loader'a donusen bir malware ailesidir. Emotet, Qakbot ve TrickBot ile birlikte calisarak buyuk ransomware operasyonlari icin ilk erisim ve lateral movement saglar. Conti ve Quantum ransomware operasyonlarinda yaygin kullanilmistir.

IOC

SHA256	`c7441ea5c8a42ce0a3afa24991c8a7f328434d2eba9c3d2a2fc26543c9288f9a`
C2	Runtime decrypt (paketli)

IcedID — Malware-Profil

IcedID banking trojan. info_IR MSI invoice lure. ConnectNamedPipe named pipe IPC. IsDebuggerPresent double anti-debug.

Malware-Typ

Loader

Programmiersprache

C++

C2-Protokoll

HTTPS

Zielsysteme

Windows

Auch bekannt als (AKA)

BokBot

Technische Details

IcedID (BazarLoader) is a banking trojan and loader first observed 2017. Man-in-the-browser attacks targeting banking credentials via web injections. BazarLoader component: delivers Ryuk, Conti, and other ransomware payloads. Uses HTTPS with TLS for C2, custom binary protocol. Delivered via malspam (Office macros, password-protected archives). Notable for forked distribution: Standard IcedID vs. Lite variant (reduced banking features). Lite/BackConnect IcedID evolved to focus solely on ransomware delivery. C2 uses high entropy DGA-like domains with .com TLD.

Attribution / Bedrohungsakteur

TA551 (Shathak), TA578

Fähigkeiten & Verhalten

Payload İndirme

Süreç Enjeksiyonu

Modüler Mimari

Kimlik Bilgisi Hırsızlığı

Yanal Hareket

Kalıcılık

Anti-VM/Sandbox

İkincil Payload Dağıtımı

IOC-Liste (1 Indikatoren)

IOC — IcedID

# SHA256
c7441ea5c8a42ce0a3afa24991c8a7f328434d2eba9c3d2a2fc26543c9288f9a

Typ	Wert	Bemerkung
sha256	c7441ea5c8a42ce0a3afa24991c8a7f328434d2eba9c3d2a2fc26543c9288f9a

IcedID — Zum vollständigen Profil →

C2-Server (5 erfasste Server für diese Familie)

Adresse	Typ	Port	Protokoll	Status	Land
162.33.177.167	ip	443	HTTPS	active	US
topfiveaccounting.com	domain	443	HTTPS	inactive	US
185.220.100.240	ip	443	HTTPS	inactive	DE
nsabx.gg	domain	443	HTTPS	inactive	—
5.8.88.226	ip	443	HTTPS	sinkholed	RU

C2-Adressen stammen ausschließlich aus vom KEYDAL-Team manuell verifizierten Malware-Samples. Kommerzielle Nutzung ist untersagt.