{"id":18608,"date":"2022-03-28T13:40:11","date_gmt":"2022-03-28T21:40:11","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2022\/03\/28\/news-12341\/"},"modified":"2022-03-28T13:40:11","modified_gmt":"2022-03-28T21:40:11","slug":"news-12341","status":"publish","type":"post","link":"https:\/\/www.palada.net\/index.php\/2022\/03\/28\/news-12341\/","title":{"rendered":"Spoofed Invoice Used to Drop IcedID"},"content":{"rendered":"
\n
\n
<\/div>\n<\/p><\/div>\n
\n

Thanks to Val Saengphaibul and Fred Gutierrez who helped contribute to this blog.<\/i><\/p>\n

Affected Platforms:<\/b> Windows
Impacted Users:<\/b> Windows users
Impact: <\/b>Compromised machines are under the control of the threat actor
Severity Level: <\/b>Medium <\/p>\n

Spearphishing crafted with industry-specific terms derived from intelligence gathering techniques to trick a recipient into opening a file is especially difficult to identify. This is especially true when an adversary has knowledge of how a business works and the processes that underpin it. Using this knowledge, a lure can be crafted that takes advantage of these day-to-day processes \u2013 for example, settling the cost of a fuel transaction.<\/p>\n

FortiGuard Labs recently encountered such a scenario, where a fuel company in Kyiv, Ukraine received a spearphishing e-mail that contained an attached invoice\u2014seemingly from another fuel provider\u2014that was spoofed. The attachment is a zip file that contains the IcedID Trojan.<\/p>\n

IcedID has been observed as far back as 2017. Its primary function is to steal banking credentials and personal information. It is also capable of deploying additional malware from the same group or partner organizations.<\/p>\n

This instance also uses an interesting deployment method. It uses the ISO format, which is mounted automatically as a disk in Windows. ISO files can also be used to create bootable CD-ROMs or install an operating system or virtual machine. It also contains a LNK (shortcut file) used to launch a DLL (Dynamic-link Library).<\/p>\n

This blog details the infection process and subsequent malware deployment by the threat actors behind IcedID.<\/p>\n

The Phishing E-mail<\/b><\/h2>\n

The e-mail originated from an IP address in Belize, at 179[.]60[.]150[.]96. It spoofs the originating e-mail address to appear to have been sent from another fuel provider in Ukraine. The e-mail contains both English and Ukrainian elements and looks realistic given the mention of extra security measures regarding the attachment.<\/p>\n<\/p><\/div>\n