Forest Global Training Partners

Cyber Risks · Cisco Talos

IcedID Banking Trojan Teams up with Ursnif/Dreambot for Distribution

Summary: Cisco Talos reported an increase in IcedID banking trojan detections across its AMP ecosystem in late February and March 2018, with many infections traced to spear-phishing emails carrying malicious Microsoft Word documents with macros. When macros are enabled, an auto-close macro runs mshta.exe to fetch a remote script that launches PowerShell to download Ursnif/Dreambot, which then downloads IcedID, and many samples also pulled a Bytecoin miner.

What you should know: The source notes spear-phishing was previously the domain of APT actors, and this campaign shows a widely distributed malware family adopting it - with attachment file names referencing a local engineering company in North Carolina and a Dallas car dealership to make the lure credible. IcedID's minimalist injection into svchost.exe uses fewer functions and less suspicious process-creation flags, which the source says makes it harder for security solutions to detect than older injection techniques.

Read the original at Cisco Talos ↗

Topics
Malware
Related