2021-04-12 (MONDAY) - ICEDID (BOKBOT) WITH BACKCONNECT TRAFFIC & ANUBIS VNC
NOTICE:
- The zip archives on this page have been updated, and they now use the new password scheme. For the new password, see the "about" page of this website.
NOTES:
- In the reference below, I mistakenly reported the BackConnect and Anubis VNC traffic as "DarkVNC" for @Unit42_Intel.
- I've fixed this blog post and the material to show the correct activity.
- For more on Backconnect, see: https://www.netresec.com/?page=Blog&month=2022-10&post=IcedID-BackConnect-Protocol
- For more on Anubis VNC, see: https://blog.nviso.eu/2023/03/20/icedids-vnc-backdoors-dark-cat-anubis-keyhole/
REFERENCE:
ASSOCIATED FILES:
- 2021-04-12-IOCs-from-IcedID-infection-with-BackConnect-and-Anubis-VNC.txt.zip 2.0 kB (2,049 bytes)
- 2021-04-12-IcedID-infection-with-BackConnect-traffic-and-Anubis-VNC-part-1-of-2.pcap.zip 20.5 MB (20,474,435 bytes)
- 2021-04-12-IcedID-infection-with-BackConnect-traffic-and-Anubis-VNC-part-2-of-2.pcap.zip 34.9 MB (34,932,986 bytes)
- 2021-04-12-IcedID-malware-and-artifacts.zip 1.1 MB (1,072,884 bytes)
ADDITIONAL NOTES:
- In response to the tweet, @netresec asked if a pcap would be available, so I santized the traffic and created this blog to share two pcaps from the infection.
- The pcap was originally too big and took too long to load in Wireshark, so I split the traffic into two pcaps.
- For details on the campaign using this method to spread IcedID, read this blog post from the Microsoft 365 Defender Threat Intelligence Team.
IMAGES
Shown above: Screenshot of video from the decoded VNC traffic.
Click here to return to the main page.