Icedid

Overview

IcedID (widely tracked across the intelligence community as BokBot) is a sophisticated modular banking trojan and initial access loader first identified in September 2017. Originally authored to intercept and manipulate online banking sessions via webinjects and local redirection proxies, IcedID evolved into one of the cybercrime underground's premier enterprise access brokers, closely partnered with threat actors such as TA551 (Gold Cabin) and Wizard Spider (UNC1878). IcedID operated as a primary launching pad for high-impact human-operated ransomware campaigns, routinely facilitating the deployment of Conti, Quantum, and BlackCat (ALPHV). In January 2023, the United States Department of Justice (Northern District of Ohio) unsealed criminal charges against Russian national Mikhail Tsarev for his role in operating IcedID and Conti. In June 2023, the US DOJ unsealed an indictment charging Russian national Maksim Rudometov, one of the primary developers and administrators of IcedID, with wire fraud, bank fraud, and Computer Fraud and Abuse Act violations. The malware features sophisticated steganographic communications and evasion mechanisms, often packing its initial loader payload inside image files.

Known aliases

Threat reports may refer to this family under multiple names:

• IcedID
• BokBot
• Trojan.IcedID
• Banking.BokBot
• Win32/IcedID

Threat Actor Attribution

Attribution is probabilistic, not a science. Each link below states its confidence level and the evidence behind it.

• Maksim Rudometov & Mikhail Tsarev (US DOJ Indictments) / Wizard Spider & TA551 High confidence
  Basis: Federal indictments unsealed in 2023 by the US Department of Justice (Northern District of Ohio) charging Maksim Rudometov with developing and administering IcedID, and Mikhail Tsarev with managing its infrastructure alongside Conti ransomware operations. [source]

Family Pedigree & Lineage

Malware authors regularly fork and iterate upon existing codebases. Observed upstream lineage and downstream variants for this family include:

Derived From / Upstream Ancestry: Gozi / Isfb

Known Derivatives & Downstream Variants: Icedid Standard (Banking Webinjects) · Icedid Lite Loader (2022-2023 Ransomware Delivery Fork) · Icedid Vnc Backdoor

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to our technical analysis hubs and the official MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1056.001: Implement Endpoint Detection and Response (EDR) to monitor for suspicious API calls related to keystroke interception. Enforce Multi-Factor Authentication (MFA) to render stolen passwords useless.
• T1071.001: Implement web filtering and SSL/TLS inspection to detect malicious command and control (C2) traffic hiding in HTTP/HTTPS.
• T1566.001: Scan email attachments for malicious macros, scripts, or suspicious archive files.

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

Exploited Vulnerabilities (CVEs)

This malware family is documented weaponizing the following common vulnerabilities and exposures:

• CVE-2021-40444 — In-depth exploitation analysis and catalog intelligence (NIST NVD ↗).
• CVE-2022-30190 — In-depth exploitation analysis and catalog intelligence (NIST NVD ↗).

Command & Control (C2) and Network Profile

How this family talks to its operators. C2 traffic can often identify a family even when its code and configuration are hard to analyse. Ports and patterns are historical and change between campaigns, so use them as hunting leads rather than block-only rules.

Indicators of Compromise

Public indicators drawn from CISA advisories and vendor reporting. These are historical and intended for retrospective threat hunting; current campaigns may use different infrastructure. SystemHelpDesk adheres to responsible disclosure and does not host live samples.

File hashes (SHA-256, sample)

Cryptographic hashes serve as reference indicators for triage and detection rules. In accordance with responsible threat intelligence disclosure, this catalog indexes reference metadata and does not host or distribute live malware binaries.

• 4a242f36f6d895f462ebc8375e87a26f8303f26cfb16954316d2ca0190abf0c1
• e236526eb8fb386f6f1c4e97669e4f5530ecdfce9a2ffb38ab8fa176df2c75a4

Delivery vectors

• Conversation-hijacking phishing campaigns with password-protected ZIP/ISO files containing malicious LNK shortcuts
• Office documents weaponized with Follina (CVE-2022-30190) or MSHTML (CVE-2021-40444) remote execution exploits

Persistence mechanisms

• Scheduled Task creation executing rundll32.exe with custom entrypoint exports
• Registry Run key creation pointing to staged payload in %PROGRAMDATA% or %LOCALAPPDATA%

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

rule MALWARE_WIN_ICEDID_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Icedid"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "icedid" ascii wide nocase
        $s2 = "icedid" ascii wide nocase
        $s3 = "bokbot" ascii wide nocase
        $s4 = "trojan.icedid" ascii wide nocase
        $s5 = "banking.bokbot" ascii wide nocase
        $s6 = "win32/icedid" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

title: SystemHelpDesk Detection - Icedid (Banking Trojan) Execution & Triage
id: 759bd794-2b8b-5ef5-bf17-c796f8633118
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Icedid malware family. Detects recon staging, certutil file payload staging,
  and web-inject process proxying characteristic of banking trojan initial loaders.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/icedid
- https://malware-families-catalog.systemhelpdesk.com/defensive/banking-trojan-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.banking-trojan
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1055
- attack.t1053_005
- attack.t1071_001
- attack.t1566_001
- attack.t1112
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \svchost.exe
    - \explorer.exe
    - \msiexec.exe
    - \certutil.exe
    CommandLine|contains:
    - -urlcache
    - -split -f
    - ipconfig /all
    - route print
    - netstat -ano
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: high

rule MALWARE_WIN_ICEDID_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Icedid tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "icedid" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Isolate the endpoint immediately from the corporate network to prevent Icedid from executing real-time Automated Transfer System (ATS) fraudulent transactions or web injections.
2. Revoke all active online banking sessions, treasury management credentials, and accounting administrator sessions accessed from the machine.
3. Analyze browser process memory (hooks on wininet.dll, ws2_32.dll, nspr4.dll) to detect and eradicate injected Icedid fraud modules.
4. Notify internal financial compliance and partner banking institutions to place temporary fraud holds or elevated monitoring on relevant accounts.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not permit financial transactions or banking portal access from any machine in the same broadcast domain until Icedid network activity is cleared.
2. Avoid relying solely on antivirus scans, as banking trojans frequently hook browser API calls directly in user-mode memory.

References & External Analysis

• US DOJ Press Release - Indictment of IcedID Creator Maksim Rudometov
• MITRE ATT&CK - IcedID (S0483)
• CISA Advisory - IcedID Malware Delivery and Ransomware Staging
• Search "icedid" on VirusTotal (External Analysis)
• Search "icedid" on Any.Run (Sandbox Sandbox)
• Search "icedid" on MalwareBazaar (Malware Samples)

Frequently Asked Questions

Related Threats (Category: Banking Trojan)

Explore other documented threats in the same operational category:

• Tinba
• Dridex
• Gozi
• Danabot
• Banbra
• Alien
• Snifula
• Tinynuke

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/icedid.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.