New Banking Trojan Similar to Dridex, Zeus, Gozi

IBM researchers uncover a new form of banking malware distributed as a second-stage infection via the Emotet Trojan.

A newly discovered banking Trojan called IcedID looks a lot Gozi, Zeus, and Dridex - but without any code overlap.
IcedID, which was discovered by IBM X-Force researchers, has capabilities similar to those older financial-stealing malware. Overall, this is similar to other banking Trojans, but thats also where I see the problem, says Limor Kessem, executive security advisor for IBM Security.
Its rare to see new banking Trojans not based off existing variants, Kessem explains. Indeed, this year has already seen the spread of
Scylex
, which also shares similarities with Zeus, as well as a Trojan called
Silence
, which mimics techniques from the Carbanak hacker group to steal from financial organizations.
IcedID - which first emerged in September of this year - targets banks, payment card providers, mobile service providers, payroll, Web mail, and ecommerce sites in the United States and Canada. Two major banks in the United Kingdom are also on the target list.
One sign of IcedIDs sophistication is its distribution through the Emotet Trojan, which is designed to amass and maintain botnets. Emotet arrives on target machines via spam emails and is typically disguised in productivity files containing malicious macros. It infects the target endpoint and remains there as a silent tool for cybercriminal groups to distribute malware.
Now its being used to serve up IcedID, which has a few tactics, tricks, and procedures (TTPs) that stand out from other common Trojan features.
IcedID can propagate over a network, which researchers say is a sign its creators intend to target large businesses. Nation-state attackers commonly use network propagation but banking Trojans rarely do, Kessem explains. The malware can move to other endpoints and infect terminal servers, an indication it targets employees email to get onto business machines.
Similar to the GootKit Trojan, IcedID monitors victims online activity by setting up a local proxy to listen and intercept communication from targeted endpoints. Attack tactics include both Web injection attacks and advanced redirection attacks, similar to the strategy employed by Dridex, researchers
explain
in a blog post.
The redirection scheme is designed to appear as seamless as possible. The legitimate banks URL is displayed in the address bar and the banks correct SSL certificate is visible. The malware listens for the target URL and when it encounters a trigger, executes a Web injection. Victims are redirected to fake banking websites and tricked into submitting their credentials, which are sent to the attackers server.
From this point forward, the attacker controls the session and typically uses social engineering to fool victims into sharing transaction authorization data.
Who broke the ice?
The company it keeps is already a telling sign that this is not an amateur group, Kessem says. The sophistication of the code is modular, and it has different details reminiscent of other organized crime groups.
Emotet, originally a banking Trojan and precursor to Dridex, has been used among Eastern European cybercrime groups. Comments in IcedIDs code indicate the actors are from Russian-speaking areas, so experts can deduce they are from a certain region.
While researchers believe this is the work of a new attacker, its difficult to say with certainty. A few malware groups have disappeared from the scene, Kessem explains, and there arent too many developers who know how to create this Trojan. Its possible the actors are related to another previously disbanded malware but because the code isnt copied, its tough to tell.
Right now, IcedID deploys on endpoints running various versions of Windows. It does not have any advanced anti-virtual machine or anti-research techniques, aside from requiring a reboot to complete full deployment and possibly evade sandboxes, and communicating via SSL for extra security and to bypass intrusion detection systems.
Researchers believe IcedIDs authors arent done, however, and will add anti-forensic features into the malware over time.
Related Content:
New Locky Ransomware Takes Another Turn
Cybersecurity Staffing Shortage Tied to Cyberattacks, Data Breaches
Hypervisors: Now a Tool to Protect against Security Blind Spots
Data Breach Record Exposure Up 305% from 2016
Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity
agenda here
.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
New Banking Trojan Similar to Dridex, Zeus, Gozi