Endpoint

11/13/2017
03:55 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

New Banking Trojan Similar to Dridex, Zeus, Gozi

IBM researchers uncover a new form of banking malware distributed as a second-stage infection via the Emotet Trojan.

A newly discovered banking Trojan called IcedID looks a lot Gozi, Zeus, and Dridex - but without any code overlap.

IcedID, which was discovered by IBM X-Force researchers, has capabilities similar to those older financial-stealing malware. "Overall, this is similar to other banking Trojans, but that's also where I see the problem," says Limor Kessem, executive security advisor for IBM Security.

It's rare to see new banking Trojans not based off existing variants, Kessem explains. Indeed, this year has already seen the spread of Scylex, which also shares similarities with Zeus, as well as a Trojan called Silence, which mimics techniques from the Carbanak hacker group to steal from financial organizations.

IcedID - which first emerged in September of this year - targets banks, payment card providers, mobile service providers, payroll, Web mail, and ecommerce sites in the United States and Canada. Two major banks in the United Kingdom are also on the target list.

One sign of IcedID's sophistication is its distribution through the Emotet Trojan, which is designed to amass and maintain botnets. Emotet arrives on target machines via spam emails and is typically disguised in productivity files containing malicious macros. It infects the target endpoint and remains there as a silent tool for cybercriminal groups to distribute malware.

Now it's being used to serve up IcedID, which has a few tactics, tricks, and procedures (TTPs) that stand out from other common Trojan features.

IcedID can propagate over a network, which researchers say is a sign its creators intend to target large businesses. Nation-state attackers commonly use network propagation but banking Trojans rarely do, Kessem explains. The malware can move to other endpoints and infect terminal servers, an indication it targets employees' email to get onto business machines.

Similar to the GootKit Trojan, IcedID monitors victims' online activity by setting up a local proxy to listen and intercept communication from targeted endpoints. Attack tactics include both Web injection attacks and advanced redirection attacks, similar to the strategy employed by Dridex, researchers explain in a blog post.

The redirection scheme is designed to appear as seamless as possible. The legitimate bank's URL is displayed in the address bar and the bank's correct SSL certificate is visible. The malware listens for the target URL and when it encounters a trigger, executes a Web injection. Victims are redirected to fake banking websites and tricked into submitting their credentials, which are sent to the attacker's server.

From this point forward, the attacker controls the session and typically uses social engineering to fool victims into sharing transaction authorization data.

Who broke the ice?

"The company it keeps is already a telling sign that this is not an amateur group," Kessem says. "The sophistication of the code is modular, and it has different details reminiscent of other organized crime groups."

Emotet, originally a banking Trojan and precursor to Dridex, has been used among Eastern European cybercrime groups. Comments in IcedID's code indicate the actors are from Russian-speaking areas, so experts can deduce they are from a certain region.

While researchers believe this is the work of a new attacker, it's difficult to say with certainty. A few malware groups have disappeared from the scene, Kessem explains, and there aren't too many developers who know how to create this Trojan. It's possible the actors are related to another previously disbanded malware but because the code isn't copied, it's tough to tell.

Right now, IcedID deploys on endpoints running various versions of Windows. It does not have any advanced anti-virtual machine or anti-research techniques, aside from requiring a reboot to complete full deployment and possibly evade sandboxes, and communicating via SSL for extra security and to bypass intrusion detection systems.

Researchers believe IcedID's authors aren't done, however, and will add anti-forensic features into the malware over time.

Related Content:

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
White House Cybersecurity Strategy at a Crossroads
Kelly Jackson Higgins, Executive Editor at Dark Reading,  7/17/2018
The Fundamental Flaw in Security Awareness Programs
Ira Winkler, CISSP, President, Secure Mentem,  7/19/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-14492
PUBLISHED: 2018-07-21
Tenda AC7 through V15.03.06.44_CN, AC9 through V15.03.05.19(6318)_CN, and AC10 through V15.03.06.23_CN devices have a Stack-based Buffer Overflow via a long limitSpeed or limitSpeedup parameter to an unspecified /goform URI.
CVE-2018-3770
PUBLISHED: 2018-07-20
A path traversal exists in markdown-pdf version <9.0.0 that allows a user to insert a malicious html code that can result in reading the local files.
CVE-2018-3771
PUBLISHED: 2018-07-20
An XSS in statics-server <= 0.0.9 can be used via injected iframe in the filename when statics-server displays directory index in the browser.
CVE-2018-5065
PUBLISHED: 2018-07-20
Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have a Use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
CVE-2018-5066
PUBLISHED: 2018-07-20
Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have an Out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.