2022-06-28 (TUESDAY) - TA578 ICEDID (BOKBOT) WITH BACKCONNECT, ANUBIS VNC AND COBALT STRIKE
NOTICE:
- The zip archives on this page have been updated, and they now use the new password scheme. For the new password, see the "about" page of this website.
NOTES:
- In the reference below, I mistakenly reported the BackConnect and Anubis VNC traffic as "DarkVNC" for @Unit42_Intel.
- I've fixed this blog post and the material to show the correct activity.
- For more on Backconnect, see: https://www.netresec.com/?page=Blog&month=2022-10&post=IcedID-BackConnect-Protocol
- For more on Anubis VNC, see: https://blog.nviso.eu/2023/03/20/icedids-vnc-backdoors-dark-cat-anubis-keyhole/
REFERENCE:
ASSOCIATED FILES:
- 2022-06-28-IOCs-for-TA578-IcedID-with-BackConnect-Anbuis-VNC-and-Cobalt-Strike.txt.zip 1.6 kB (1,625 bytes)
- 2022-06-28-TA578-thread-hijacked-email-pushing-IcedID-155214-UTC.eml.zip 285 kB (284,634 bytes)
- 2022-06-28-IcedID-malware-and-artifacts.zip 2.2 MB (2,213,753 bytes)
- 2022-06-28-TA578-IcedID-with-BackConnect-and-Anubis-VNC-and-Cobalt-Strike.pcap.zip 27.0 MB (26,951,454 bytes)
IMAGES
Shown above: Screenshot of video from the decoded VNC traffic.
Click here to return to the main page.