Three Variants of IcedID Malware Discovered

3 new variants of the banking Trojan acknowledged as IcedID have been found in the wild, showcasing a typical code foundation but with a number of essential distinctions.

Security researchers at Proofpoint explained the malware samples in an advisory published earlier nowadays, which names them Conventional, Lite and Forked IcedID variants respectively.

The initially variant is the most generally observed in the wild and was first found in 2017. This Common variant has an original loader that contacts a Loader command and handle (C2) server and downloads a DLL Loader, which then delivers the IcedID bot.

Browse additional on IcedID listed here: FBI Issues Ransomware Team Flash Alert

The IcedID Lite variant, on the other hand, was found by Proofpoint in November 2022 as section of an Emotet marketing campaign by TA542. 

“[It]consists of a static URL to down load a ‘Bot Pack’ file with a static identify […] which success in the IcedID Lite DLL Loader, and then delivers the Forked edition of IcedID Bot, leaving out the web injects and again join operation that would commonly be used for banking fraud,” reads the advisory, written by Pim Trouerbach, Kelsey Merriman and Joe Smart.

The third variant observed by the workforce was learned in a sequence of seven campaigns in February 2023.

“This variant was distributed by TA581 and 1 unattributed menace exercise cluster which acted as preliminary access facilitators,” wrote Trouerbach, Merriman and Sensible. “The campaigns applied a range of email attachments this sort of as Microsoft OneNote attachments and to some degree scarce to see .URL attachments, which led to the Forked variant of IcedID.”

According to the security scientists, the IcedID Forked Loader observed in February 2023 is a lot more identical to the Standard IcedID Loader as it contacts a Loader C2 server to fetch both the DLL loader and the bot. 

“That DLL loader has comparable artifacts to the Lite Loader and also hundreds the Forked IcedID Bot,” they stated.

According to Proofpoint, the new variants hint that substantial effort and hard work is heading into the upcoming of IcedID and its codebase.

“While traditionally IcedID’s key operate was a banking Trojan, the removal of banking operation aligns with the general landscape change away from banking malware and an rising concentrate on remaining a loader for observe-on infections, which include ransomware,” the advisory concludes.“While many menace actors will continue on to use the Typical variant, it is very likely the new variants will keep on to be utilized to facilitate extra malware attacks.”

Some parts of this article are sourced from:
www.infosecurity-magazine.com