Icedid

Overview

Executive Summary

Infection Vector and Technical Capabilities

• Web Injection (Man-in-the-Browser): Its legacy capability involves intercepting web traffic to inject fraudulent fields into legitimate banking portals, bypassing HTTPS and 2FA to steal credentials and initiate unauthorized wire transfers.
• Advanced Evasion and Steganography: IcedID employs highly complex evasion techniques. It often downloads its core malicious module hidden within an innocent-looking image file (steganography) to bypass network intrusion detection systems (NIDS).
• Lateral Movement and Ransomware Deployment: Once active, it maps the Active Directory environment, dumps credentials (via Mimikatz modules), and attempts to move laterally to the Domain Controller. Once the network is fully compromised, the "access" is sold to a ransomware cartel for final deployment.

Threat Assessment

Incident Response and Remediation

• Declare a Major Incident: Immediately engage specialized third-party Incident Response (IR) teams. Isolate the affected endpoints immediately, but do not turn them off, to preserve memory forensics.
• Active Directory Lockdown: The immediate threat is lateral movement. Hunt for anomalous admin logins, reset krbtgt account passwords (twice), and scrutinize Domain Admin account activity.
• Enterprise-Wide Eradication: Remediating IcedID requires a coordinated network-wide effort to identify all compromised hosts, sever all C2 connections, and rebuild affected machines from known-good baselines.

Known aliases

Threat reports may refer to this family under multiple names:

• Trojan.IcedID
• Banking.BokBot
• Win32/IcedID

MITRE ATT&CK Techniques

This family has been observed using the following ATT&CK techniques: T1185 T1055 T1027.003 T1078

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1185: Enforce strong MFA and use browser isolation or hardened browsers for sensitive financial or administrative portals to defeat session hijacking.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_ICEDID {
    meta:
        description = "Detects Icedid (banking_trojan)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "icedid" ascii wide nocase
        $s2 = "trojan.icedid" ascii wide nocase
        $s3 = "banking.bokbot" ascii wide nocase
        $s4 = "win32/icedid" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Icedid Activity
id: 024ed2a92920088ceff69104f680c98f
status: experimental
description: Detects generic indicators of the icedid malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*icedid*"
            - "*trojan.icedid*"
            - "*banking.bokbot*"
            - "*win32/icedid*"
    condition: selection
level: medium

References & External Analysis

• MITRE ATT&CK: IcedID (S0483)
• Search "icedid" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: banking_trojan)

Explore other malware families in the same category:

• Vawtrak
• Blackmoon
• Shylock
• Shiz
• Zusy

Machine-readable

Get this profile as JSON: https://jordan123234-malware-families-explorer.static.hf.space/api/icedid.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.