IcedID Infrastructure - Detect

ID: icedid

Severity: info

Author: pussycat0x

Tags: c2,ssl,tls,ir,osint,malware,bokbot,icedid

Description

IcedID, also known as BokBot, is a modular banking trojan that targets user financial information and is capable of acting as a dropper for other malware. It uses a man-in-the-browser attack to steal financial information, including login credentials for online banking sessions. Once it successfully completes its initial attack, it uses the stolen information to take over banking accounts and automate fraudulent transactions. IcedID is primarily dropped as a secondary payload from other malware, most notably Emotet, in addition to its own malspam campaigns. IcedID uses multiple injection methods to evade antivirus and other malware detection methods, such as injecting itself into operating system (OS) memory and regular processes. The malware authors are known to update IcedID to increase persistence and evade new detection efforts.

YAML Source

id: icedid

info:
  name: IcedID Infrastructure - Detect
  author: pussycat0x
  severity: info
  description: |
    IcedID, also known as BokBot, is a modular banking trojan that targets user financial information and is capable of acting as a dropper for other malware. It uses a man-in-the-browser attack to steal financial information, including login credentials for online banking sessions. Once it successfully completes its initial attack, it uses the stolen information to take over banking accounts and automate fraudulent transactions. IcedID is primarily dropped as a secondary payload from other malware, most notably Emotet, in addition to its own malspam campaigns. IcedID uses multiple injection methods to evade antivirus and other malware detection methods, such as injecting itself into operating system (OS) memory and regular processes. The malware authors are known to update IcedID to increase persistence and evade new detection efforts.
  metadata:
    verified: "true"
    max-request: 1
    censys-query: CN=localhost, C=AU, ST=Some-State, O=Internet Widgits Pty Ltd
  tags: c2,ssl,tls,ir,osint,malware,bokbot,icedid
ssl:
  - address: "{{Host}}:{{Port}}"
    matchers:
      - type: word
        part: subject_dn
        words:
          - "O=Internet Widgits Pty Ltd, ST=Some-State, C=AU, CN=localhost"

    extractors:
      - type: json
        json:
          - ".subject_dn"
# digest: 4b0a00483046022100f51f029b876b58673cf3398408e8b61276f3bb441f545ae7115dc45904e8ac9b022100e5d32aa34b7fd3d4d17565ae0bf286f242648c2fcf4143386872679371f71955:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "ssl/c2/icedid.yaml"

View on Github