Juniper IcedID June 2020

IcedID has packed and encrypted its loader module.

IcedID has embedded binaries within RC4 encrypted .png files.

IcedID has utilzed encrypted binaries and base64 encoded strings.

IcedID has used WMI to execute binaries.

IcedID has created a scheduled task to establish persistence.

IcedID has used obfuscated VBA string expressions.

IcedID has used HTTPS in communications with C2.

IcedID has the ability to download additional modules and a configuration file from C2.

IcedID has called ZwWriteVirtualMemory, ZwProtectVirtualMemory, ZwQueueApcThread, and NtResumeThread to inject itself into a remote process.

IcedID has used web injection attacks to redirect victims to spoofed sites designed to harvest banking and other credentials. IcedID can use a self signed TLS certificate in connection with the spoofed site and simultaneously maintains a live connection with the legitimate site to display the correct URL and certificates in the browser.

IcedID has been executed through Word and Excel files with malicious embedded macros and through ISO and LNK files that execute the malicious DLL.

IcedID can inject itself into a suspended msiexec.exe process to send beacons to C2 while appearing as a normal msi application. IcedID has also used msiexec.exe to deploy the IcedID loader.

IcedID has been delivered via phishing e-mails with malicious attachments.

IcedID has used SSL and TLS in communications with C2.