New Banking Trojan Similar to Dridex, Zeus, Gozi

A newly discovered banking Trojan called IcedID looks a lot Gozi, Zeus, and Dridex - but without any code overlap.

IcedID, which was discovered by IBM X-Force researchers, has capabilities similar to those older financial-stealing malware. "Overall, this is similar to other banking Trojans, but that's also where I see the problem," says Limor Kessem, executive security advisor for IBM Security.

It's rare to see new banking Trojans not based off existing variants, Kessem explains. Indeed, this year has already seen the spread of Scylex, which also shares similarities with Zeus, as well as a Trojan called Silence, which mimics techniques from the Carbanak hacker group to steal from financial organizations.

IcedID - which first emerged in September of this year - targets banks, payment card providers, mobile service providers, payroll, Web mail, and ecommerce sites in the United States and Canada. Two major banks in the United Kingdom are also on the target list.

One sign of IcedID's sophistication is its distribution through the Emotet Trojan, which is designed to amass and maintain botnets. Emotet arrives on target machines via spam emails and is typically disguised in productivity files containing malicious macros. It infects the target endpoint and remains there as a silent tool for cybercriminal groups to distribute malware.

Now it's being used to serve up IcedID, which has a few tactics, tricks, and procedures (TTPs) that stand out from other common Trojan features.

IcedID can propagate over a network, which researchers say is a sign its creators intend to target large businesses. Nation-state attackers commonly use network propagation but banking Trojans rarely do, Kessem explains. The malware can move to other endpoints and infect terminal servers, an indication it targets employees' email to get onto business machines.

Similar to the GootKit Trojan, IcedID monitors victims' online activity by setting up a local proxy to listen and intercept communication from targeted endpoints. Attack tactics include both Web injection attacks and advanced redirection attacks, similar to the strategy employed by Dridex, researchers explain in a blog post.

The redirection scheme is designed to appear as seamless as possible. The legitimate bank's URL is displayed in the address bar and the bank's correct SSL certificate is visible. The malware listens for the target URL and when it encounters a trigger, executes a Web injection. Victims are redirected to fake banking websites and tricked into submitting their credentials, which are sent to the attacker's server.

From this point forward, the attacker controls the session and typically uses social engineering to fool victims into sharing transaction authorization data.

Who broke the ice?

"The company it keeps is already a telling sign that this is not an amateur group," Kessem says. "The sophistication of the code is modular, and it has different details reminiscent of other organized crime groups."

Emotet, originally a banking Trojan and precursor to Dridex, has been used among Eastern European cybercrime groups. Comments in IcedID's code indicate the actors are from Russian-speaking areas, so experts can deduce they are from a certain region.

While researchers believe this is the work of a new attacker, it's difficult to say with certainty. A few malware groups have disappeared from the scene, Kessem explains, and there aren't too many developers who know how to create this Trojan. It's possible the actors are related to another previously disbanded malware but because the code isn't copied, it's tough to tell.

Right now, IcedID deploys on endpoints running various versions of Windows. It does not have any advanced anti-virtual machine or anti-research techniques, aside from requiring a reboot to complete full deployment and possibly evade sandboxes, and communicating via SSL for extra security and to bypass intrusion detection systems.

Researchers believe IcedID's authors aren't done, however, and will add anti-forensic features into the malware over time.

Related Content:

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.