Summary: 2025/04/19 12:28
First reported date: 2017/11/13
Inquiry period : 2025/03/20 12:28 ~ 2025/04/19 12:28 (1 months), 8 search results
전 기간대비 13% 높은 트렌드를 보이고 있습니다.
전 기간대비 상승한 Top5 연관 키워드는 IcedID Report Email Exploit intelligence 입니다.
악성코드 유형 TrickBot SmokeLoader SystemBC Pikabot BumbleBee Botnet FlawedAmmyy Dridex Houdini TA505 Evil Corp Wshrat LUNAR SPIDER Lobshot 도 새롭게 확인됩니다.
공격자 Volt Typhoon 도 새롭게 확인됩니다.
공격기술 RCE Backdoor Malvertising hijack 도 새롭게 확인됩니다.
기관 및 기업 Google Kaspersky Saudi Arabia Binance Sparrow Oracle Cisco Taiwan Australia Russia 도 새롭게 확인됩니다.
기타 Operation target Software SaudiArabia att 등 신규 키워드도 확인됩니다.
IcedID, also known as BokBot, is a modular banking trojan that targets user financial information and is capable of acting as a dropper for other malware
* 최근 뉴스기사 Top3:
ㆍ 2025/04/16 Threat actors misuse Node.js to deliver malware and other malicious payloads
ㆍ 2025/04/11 DNS Response analysis with KQL: queries, answers, TTL, RTT & more
ㆍ 2025/04/10 Operation Endgame follow-up cracks down on Smokeloader botnet
참고로 동일한 그룹의 악성코드 타입은 FormBook QakBot RedLine 등 101개 종이 확인됩니다.
Trend graph by period
Related keyword cloud
Top 100| # | Trend | Count | Comparison |
|---|---|---|---|
| 1 | IcedID | 8 | ▲ 1 (13%) |
| 2 | Malware | 7 | - 0 (0%) |
| 3 | Report | 7 | ▲ 1 (14%) |
| 4 | Microsoft | 5 | ▼ -1 (-20%) |
| 5 | Update | 5 | - 0 (0%) |
| 6 | Windows | 4 | ▼ -1 (-25%) |
| 7 | United States | 4 | ▼ -2 (-50%) |
| 8 | 4 | ▲ 2 (50%) | |
| 9 | Exploit | 4 | ▲ 1 (25%) |
| 10 | 3 | ▼ -2 (-67%) | |
| 11 | GameoverP2P | 3 | ▼ -3 (-100%) |
| 12 | Advertising | 3 | - 0 (0%) |
| 13 | intelligence | 3 | ▲ 2 (67%) |
| 14 | c&c | 3 | ▼ -2 (-67%) |
| 15 | 3 | ▼ -3 (-100%) | |
| 16 | Vulnerability | 3 | ▼ -2 (-67%) |
| 17 | Campaign | 3 | - 0 (0%) |
| 18 | powershell | 3 | - 0 (0%) |
| 19 | MFA | 2 | ▼ -1 (-50%) |
| 20 | 2 | ▲ new | |
| 21 | Operation | 2 | ▲ new |
| 22 | WMI | 2 | - 0 (0%) |
| 23 | target | 2 | ▲ new |
| 24 | TrickBot | 2 | ▲ new |
| 25 | Software | 2 | ▲ new |
| 26 | RCE | 2 | ▲ new |
| 27 | attack | 2 | ▲ 1 (50%) |
| 28 | ZeroDay | 2 | ▲ 1 (50%) |
| 29 | China | 2 | - 0 (0%) |
| 30 | Browser | 2 | ▼ -1 (-50%) |
| 31 | XDR | 2 | ▲ 1 (50%) |
| 32 | Victim | 2 | - 0 (0%) |
| 33 | Backdoor | 2 | ▲ new |
| 34 | GitHub | 2 | ▼ -1 (-50%) |
| 35 | Stealer | 2 | - 0 (0%) |
| 36 | EDR | 2 | ▲ 1 (50%) |
| 37 | Kaspersky | 2 | ▲ new |
| 38 | Malvertising | 1 | ▲ new |
| 39 | SaudiArabia | 1 | ▲ new |
| 40 | Saudi Arabia | 1 | ▲ new |
| 41 | att | 1 | ▲ new |
| 42 | SmokeLoader | 1 | ▲ new |
| 43 | SystemBC | 1 | ▲ new |
| 44 | Java | 1 | ▼ -2 (-200%) |
| 45 | Pikabot | 1 | ▲ new |
| 46 | followup | 1 | ▲ new |
| 47 | BumbleBee | 1 | ▲ new |
| 48 | Cryptocurrency | 1 | ▼ -2 (-200%) |
| 49 | IPv | 1 | ▲ new |
| 50 | TTLs | 1 | ▲ new |
| 51 | parsejson | 1 | ▲ new |
| 52 | AdditionalFields | 1 | ▲ new |
| 53 | VBScript | 1 | ▼ -1 (-100%) |
| 54 | DNS | 1 | ▲ new |
| 55 | Binance | 1 | ▲ new |
| 56 | arrest | 1 | ▲ new |
| 57 | Phishing | 1 | ▼ -4 (-400%) |
| 58 | hijack | 1 | ▲ new |
| 59 | Vawtrak | 1 | - 0 (0%) |
| 60 | SSRF | 1 | - 0 (0%) |
| 61 | Social Engineering | 1 | ▼ -1 (-100%) |
| 62 | Endgame | 1 | ▲ new |
| 63 | Botnet | 1 | ▲ new |
| 64 | DoTNet | 1 | ▲ new |
| 65 | United Kingd | 1 | ▲ new |
| 66 | ESET | 1 | ▼ -1 (-100%) |
| 67 | Sparrow | 1 | ▲ new |
| 68 | FlawedAmmyy | 1 | ▲ new |
| 69 | Dridex | 1 | ▲ new |
| 70 | Cobalt Strike | 1 | ▲ new |
| 71 | G | 1 | ▲ new |
| 72 | Chrome | 1 | - 0 (0%) |
| 73 | Houdini | 1 | ▲ new |
| 74 | Oracle | 1 | ▲ new |
| 75 | Cisco | 1 | ▲ new |
| 76 | Cobalt | 1 | ▲ new |
| 77 | MimiKatz | 1 | - 0 (0%) |
| 78 | Meterpreter | 1 | ▲ new |
| 79 | Volt Typhoon | 1 | ▲ new |
| 80 | Zero Trust | 1 | - 0 (0%) |
| 81 | Taiwan | 1 | ▲ new |
| 82 | SMB | 1 | - 0 (0%) |
| 83 | IoC | 1 | ▼ -3 (-300%) |
| 84 | TA505 | 1 | ▲ new |
| 85 | Evil Corp | 1 | ▲ new |
| 86 | Ransomware | 1 | - 0 (0%) |
| 87 | Wshrat | 1 | ▲ new |
| 88 | ChatGPT | 1 | ▲ new |
| 89 | LUNAR SPIDER | 1 | ▲ new |
| 90 | gang | 1 | ▲ new |
| 91 | average | 1 | ▲ new |
| 92 | SPIDER | 1 | ▲ new |
| 93 | LUNAR | 1 | ▲ new |
| 94 | eCrime | 1 | ▲ new |
| 95 | Australia | 1 | ▲ new |
| 96 | FIN11 | 1 | ▲ new |
| 97 | Lobshot | 1 | ▲ new |
| 98 | Distribution | 1 | ▼ -2 (-200%) |
| 99 | Russia | 1 | ▲ new |
| 100 | IBM | 1 | ▲ new |
Special keyword group
Top 5
Malware Type
This is the type of malware that is becoming an issue.
| Keyword | Average | Label |
|---|---|---|
| IcedID |
|
8 (26.7%) |
| GameoverP2P |
|
3 (10%) |
| TrickBot |
|
2 (6.7%) |
| SmokeLoader |
|
1 (3.3%) |
| SystemBC |
|
1 (3.3%) |
Attacker & Actors
The status of the attacker or attack group being issued.
| Keyword | Average | Label |
|---|---|---|
| Volt Typhoon |
|
1 (100%) |
Country & Company
This is a country or company that is an issue.
| Keyword | Average | Label |
|---|---|---|
| Microsoft |
|
5 (20.8%) |
| United States |
|
4 (16.7%) |
|
|
2 (8.3%) | |
| China |
|
2 (8.3%) |
| Kaspersky |
|
2 (8.3%) |
Malware Family
Top 5
A malware family is a group of applications with similar attack techniques.
In this trend, it is classified into Ransomware, Stealer, RAT or Backdoor, Loader, Botnet, Cryptocurrency Miner.
Threat info
Last 5SNS
(Total : 1)News
(Total : 7)IcedID Malware Report Attacker Microsoft Update United States Exploit Windows Email intelligence Vulnerability Advertising Campaign LinkedIn Twitter GameoverP2P powershell c&c RCE WMI Operation target Kaspersky Backdoor Software EDR ZeroDay XDR attack TrickBot Google GitHub China MFA Victim Stealer Browser Vawtrak SmokeLoader Binance Cryptocurrency VBScript Phishing Social Engineering SystemBC SSRF Pikabot DoTNet BumbleBee hijack arrest Botnet Java DNS Malvertising Distribution Cisco Cobalt Strike Chrome Houdini Oracle Sparrow MimiKatz FlawedAmmyy Meterpreter Volt Typhoon Zero Trust Taiwan SMB IoC Dridex TA505 Saudi Arabia Wshrat ESET Ransomware ChatGPT Australia Lobshot Russia Cobalt IBM QRadar Security Suite LockBit Clop FIN11 Evil Corp
| No | Title | Date |
|---|---|---|
| 1 | Threat actors misuse Node.js to deliver malware and other malicious payloads - Malware.News | 2025.04.16 |
| 2 | DNS Response analysis with KQL: queries, answers, TTL, RTT & more - Malware.News | 2025.04.11 |
| 3 | Operation Endgame follow-up cracks down on Smokeloader botnet - Malware.News | 2025.04.10 |
| 4 | Stopping attacks against on-premises Exchange Server and SharePoint Server with AMSI - Malware.News | 2025.04.10 |
| 5 | Exploitation of CLFS zero-day leads to ransomware activity - Malware.News | 2025.04.09 |
Additional information
| No | Title | Date |
|---|---|---|
| 1 | Tesla to Delay Production of Cheaper EVs, Reuters Reports - Bloomberg Technology | 2025.04.19 |
| 2 | When Vulnerability Information Flows are Vulnerable Themselves - Malware.News | 2025.04.19 |
| 3 | CISA warns threat hunting staff of end to Google, Censys contracts as agency cuts set in - Malware.News | 2025.04.19 |
| 4 | Radiology practice reportedly working with FBI after ‘data security incident’ - Malware.News | 2025.04.19 |
| 5 | Text scams grow to steal hundreds of millions of dollars - Malware.News | 2025.04.19 |
| View only the last 5 | ||
| No | Title | Date |
|---|---|---|
| 1 | Threat actors misuse Node.js to deliver malware and other malicious payloads - Malware.News | 2025.04.16 |
| 2 | Threat actors misuse Node.js to deliver malware and other malicious payloads - Malware.News | 2025.04.16 |
| 3 | DNS Response analysis with KQL: queries, answers, TTL, RTT & more - Malware.News | 2025.04.11 |
| 4 | Stopping attacks against on-premises Exchange Server and SharePoint Server with AMSI - Malware.News | 2025.04.10 |
| 5 | Exploitation of CLFS zero-day leads to ransomware activity - Malware.News | 2025.04.09 |
| View only the last 5 | ||
| No | Request | Hash(md5) | Report No | Date |
|---|---|---|---|---|
| 1 |  797979.dllIcedID Gen2 UPX Malicious Library OS Processor Check DLL PE64 PE File | 3c6363eaa26123a42f5051a443385d1e | 40677 | 2023.04.22 |
| 2 |  V-aim.dllIcedID VMProtect PE File PE64 DLL | 68d7d6f7f4c22abe217d12cc42be689f | 13668 | 2021.07.19 |
| 3 |  V-aim.dllIcedID VMProtect PE64 PE File DLL | 68d7d6f7f4c22abe217d12cc42be689f | 13426 | 2021.07.13 |
| Level | Description |
|---|---|
| watch | File has been identified by 16 AntiVirus engines on VirusTotal as malicious |
| notice | A process attempted to delay the analysis task. |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) |
| notice | HTTP traffic contains suspicious features which may be indicative of malware related traffic |
| notice | Performs some HTTP requests |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| notice | Uses Windows utilities for basic Windows functionality |
| info | Checks if process is being debugged by a debugger |
| info | One or more processes crashed |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
| info | This executable has a PDB path |
| Network | ET MALWARE Win32/IcedID Request Cookie |
| No | Category | URL | CC | ASN Co | Date |
|---|---|---|---|---|---|
| 1 | c2 | http://mistulinno.com/ | US  | CLOUDFLARENET | 2023.10.20 |
| 2 | malicious | http://89.147.111.46/gWUA/ | HU  | Gelka Hirtech Kft | 2023.10.17 |
| 3 | c2 | http://aptekoagraliy.com/ | US | CLOUDFLARENET | 2023.10.17 |
| 4 | malicious | http://155.138.164.116/RfOhPtl/JaZ | US | AS-CHOOPA | 2023.10.03 |
| 5 | malicious | http://155.138.160.67/fYYQ0/1J | US | AS-CHOOPA | 2023.10.03 |
| View only the last 5 | |||||
| No | URL | CC | ASN Co | Reporter | Date |
|---|---|---|---|---|---|
| 1 | https://amtri.ma/opc/ IcedID TA577 TR zip | MA  | Hostoweb Ltd | 0x48215333 | 2023.11.29 |
| 2 | https://cavaempaque.com/sedx/ IcedID TR | US | AS-TIERP-36024 | Cryptolaemus1 | 2023.11.28 |
| 3 | https://channeldistribution.net/evo/ IcedID TR | US | Host Europe GmbH | Cryptolaemus1 | 2023.11.28 |
| 4 | https://bossajazzbrasil.com/iii/ IcedID TR | US | UNIFIEDLAYER-AS-1 | Cryptolaemus1 | 2023.11.28 |
| 5 | https://crpao.ac.th/tade/ IcedID TR | TH  | ... | Cryptolaemus1 | 2023.11.28 |
| View only the last 5 | |||||