Endpoint

11/13/2017
03:55 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

New Banking Trojan Similar to Dridex, Zeus, Gozi

IBM researchers uncover a new form of banking malware distributed as a second-stage infection via the Emotet Trojan.

A newly discovered banking Trojan called IcedID looks a lot Gozi, Zeus, and Dridex - but without any code overlap.

IcedID, which was discovered by IBM X-Force researchers, has capabilities similar to those older financial-stealing malware. "Overall, this is similar to other banking Trojans, but that's also where I see the problem," says Limor Kessem, executive security advisor for IBM Security.

It's rare to see new banking Trojans not based off existing variants, Kessem explains. Indeed, this year has already seen the spread of Scylex, which also shares similarities with Zeus, as well as a Trojan called Silence, which mimics techniques from the Carbanak hacker group to steal from financial organizations.

IcedID - which first emerged in September of this year - targets banks, payment card providers, mobile service providers, payroll, Web mail, and ecommerce sites in the United States and Canada. Two major banks in the United Kingdom are also on the target list.

One sign of IcedID's sophistication is its distribution through the Emotet Trojan, which is designed to amass and maintain botnets. Emotet arrives on target machines via spam emails and is typically disguised in productivity files containing malicious macros. It infects the target endpoint and remains there as a silent tool for cybercriminal groups to distribute malware.

Now it's being used to serve up IcedID, which has a few tactics, tricks, and procedures (TTPs) that stand out from other common Trojan features.

IcedID can propagate over a network, which researchers say is a sign its creators intend to target large businesses. Nation-state attackers commonly use network propagation but banking Trojans rarely do, Kessem explains. The malware can move to other endpoints and infect terminal servers, an indication it targets employees' email to get onto business machines.

Similar to the GootKit Trojan, IcedID monitors victims' online activity by setting up a local proxy to listen and intercept communication from targeted endpoints. Attack tactics include both Web injection attacks and advanced redirection attacks, similar to the strategy employed by Dridex, researchers explain in a blog post.

The redirection scheme is designed to appear as seamless as possible. The legitimate bank's URL is displayed in the address bar and the bank's correct SSL certificate is visible. The malware listens for the target URL and when it encounters a trigger, executes a Web injection. Victims are redirected to fake banking websites and tricked into submitting their credentials, which are sent to the attacker's server.

From this point forward, the attacker controls the session and typically uses social engineering to fool victims into sharing transaction authorization data.

Who broke the ice?

"The company it keeps is already a telling sign that this is not an amateur group," Kessem says. "The sophistication of the code is modular, and it has different details reminiscent of other organized crime groups."

Emotet, originally a banking Trojan and precursor to Dridex, has been used among Eastern European cybercrime groups. Comments in IcedID's code indicate the actors are from Russian-speaking areas, so experts can deduce they are from a certain region.

While researchers believe this is the work of a new attacker, it's difficult to say with certainty. A few malware groups have disappeared from the scene, Kessem explains, and there aren't too many developers who know how to create this Trojan. It's possible the actors are related to another previously disbanded malware but because the code isn't copied, it's tough to tell.

Right now, IcedID deploys on endpoints running various versions of Windows. It does not have any advanced anti-virtual machine or anti-research techniques, aside from requiring a reboot to complete full deployment and possibly evade sandboxes, and communicating via SSL for extra security and to bypass intrusion detection systems.

Researchers believe IcedID's authors aren't done, however, and will add anti-forensic features into the malware over time.

Related Content:

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
12 Free, Ready-to-Use Security Tools
Steve Zurier, Freelance Writer,  10/12/2018
Most IT Security Pros Want to Change Jobs
Dark Reading Staff 10/12/2018
6 Security Trends for 2018/2019
Curtis Franklin Jr., Senior Editor at Dark Reading,  10/15/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-13399
PUBLISHED: 2018-10-16
The Microsoft Windows Installer for Atlassian Fisheye and Crucible before version 4.6.1 allows local attackers to escalate privileges because of weak permissions on the installation directory.
CVE-2018-18381
PUBLISHED: 2018-10-16
Z-BlogPHP 1.5.2.1935 (Zero) has a stored XSS Vulnerability in zb_system/function/c_system_admin.php via the Content-Type header during the uploading of image attachments.
CVE-2018-18382
PUBLISHED: 2018-10-16
Advanced HRM 1.6 allows Remote Code Execution via PHP code in a .php file to the user/update-user-avatar URI, which can be accessed through an "Update Profile" "Change Picture" (aka user/edit-profile) action.
CVE-2018-18374
PUBLISHED: 2018-10-16
XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter.
CVE-2018-18375
PUBLISHED: 2018-10-16
goform/getProfileList in Orange AirBox Y858_FL_01.16_04 allows attackers to extract APN data (name, number, username, and password) via the rand parameter.