IcedID (BokBot): Forensic Reverse-Engineering & Architectural Dossier

{
  "compiler": "Microsoft Visual C++ (MSVC x86/x64, CRT-free)",
  "runtime": "Custom native Win32/NTAPI execution engine",
  "binary_footprint": "Modular DLL and stager binaries, typ. 50 KB - 180 KB unpacked",
  "stub_size": "65,536 bytes (typical initial stager DLL), reconstructing 250 KB core bot from PNG steganography",
  "packer_obfuscation": "Steganographic image embedding, encrypted strings, rolling XOR decryption loops, and custom entry-point packers",
  "subsystem": "Windows GUI / DLL (Subsystem 2)",
  "entry_point_flow": "Loader executes via rundll32.exe or regsvr32.exe -> Decrypts embedded C2 configuration -> Transmits HTTP GET requesting PNG asset -> Parses PNG IDAT chunks to extract encrypted binary payload -> Decrypts payload using rolling 8-byte XOR key -> Injects core bot into svchost.exe via Early Bird APC -> Establishes local loopback proxy for browser network redirection",
  "technical_summary": "IcedID (also designated BokBot) is a sophisticated headless modular banking trojan evolved into a high-priority initial access loader for ransomware operators. It possesses no public desktop GUI builder, operating entirely via automated affiliate distribution pipelines. IcedID is renowned for concealing its secondary executable modules inside valid PNG image files, parsing image chunk structures in memory to bypass network perimeter payload inspection. The core implant executes Man-in-the-Browser (MitB) interception by setting up a local loopback proxy and injecting into browser processes, redirecting banking sessions and facilitating Cobalt Strike lateral movement."
}

{
  "type": "Headless / CLI / Config-Driven Loader",
  "builder_tabs": null,
  "config_fields": [
    {
      "offset": "0x0000",
      "field": "ProjectID (Campaign Tag)",
      "type": "10-digit Decimal String",
      "description": "Affiliate campaign identifier (e.g., '1638491024')"
    },
    {
      "offset": "0x0014",
      "field": "C2_Domain_Primary",
      "type": "Encrypted ASCII String",
      "description": "Primary command-and-control server hostname"
    },
    {
      "offset": "0x0054",
      "field": "C2_Domain_Backup",
      "type": "Encrypted ASCII String",
      "description": "Secondary fallback C2 server hostname"
    },
    {
      "offset": "0x0094",
      "field": "Stego_URI_Path",
      "type": "Encrypted ASCII String",
      "description": "Relative URL path requesting the steganographic PNG image"
    },
    {
      "offset": "0x00C0",
      "field": "XOR_Key",
      "type": "Byte Array (8 bytes)",
      "description": "Rolling XOR key applied to unpack the PNG payload buffer"
    }
  ],
  "payload_generation_flags": [
    "Architecture: x86 / x64 Dual-Build",
    "Steganography Chunk Target: IDAT / Custom Chunk",
    "Network Interception: Local Loopback Proxy (127.0.0.1)",
    "Host Injection: C:\\Windows\\System32\\svchost.exe"
  ],
  "operator_commands": [
    "0x01: Download and execute secondary executable file",
    "0x02: Inject Man-in-the-Browser redirection configuration into browser process",
    "0x03: Establish reverse SOCKS proxy tunnel through victim host",
    "0x04: Execute reconnaissance batch script and return system profile",
    "0x05: Terminate active bot instance and delete local persistence hooks"
  ],
  "interface_telemetry_analysis": "IcedID operations are orchestrated through distributed backend infrastructure. Compromised bot nodes report telemetry via HTTPS cookie headers (__gads, _gat) containing encoded system identifiers, domain trust relationships, and active antivirus engines. Operators interact with infected enterprises by issuing task queues to deploy secondary access modules or initiate interactive hands-on-keyboard intrusion phases."
}

struct IcedID_(BokBot)_Config {
    uint32_t magic;
    char c2_host[128];
    uint16_t port;
    char install_path[260];
    char mutex[64];
    uint8_t aes_key[32];
};

{
  "injection_chain": "Early Bird APC Injection: IcedID stager creates an instance of C:\\Windows\\System32\\svchost.exe in suspended state using CreateProcessW -> Allocates virtual memory in the remote process via NtAllocateVirtualMemory (PAGE_EXECUTE_READWRITE) -> Writes decrypted core module using NtWriteVirtualMemory -> Queues an Asynchronous Procedure Call (APC) to the main thread via NtQueueApcThread -> Calls NtResumeThread, triggering execution of the injected code before the process entry point executes.",
  "ntapi_functions": [
    "ntdll!NtAllocateVirtualMemory",
    "ntdll!NtWriteVirtualMemory",
    "ntdll!NtProtectVirtualMemory",
    "ntdll!NtQueueApcThread",
    "ntdll!NtResumeThread",
    "ws2_32!connect",
    "ws2_32!send",
    "ws2_32!recv"
  ],
  "process_hollowing_target": "C:\\Windows\\System32\\svchost.exe or explorer.exe",
  "persistence_mechanics": [
    "Scheduled Task: Creation of persistent task running under SYSTEM or active user context at logon",
    "Registry Key: HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run entry pointing to dropped DLL",
    "COM Hijacking: Hijacking CLSID registry entries executed during shell initialization"
  ],
  "evasion_hooks": [
    "Steganographic Evasion: Core executable payloads are formatted within standard PNG image chunk specifications, bypassing content-based network inspection engines",
    "Local Proxy Redirection: Intercepts browser networking locally rather than installing conspicuous driver hooks",
    "Early Bird APC: Executes payload before EDR user-mode hooks are initialized in the target process space"
  ],
  "anti_analysis": [
    "Validates PNG file format headers (0x89 0x50 0x4E 0x47) before executing extraction routines",
    "Checks system domain membership to filter non-corporate sandbox environments",
    "Sleep latency checks detecting automated hypervisor execution acceleration"
  ]
}

Concrete technical breakdown of functional modules implemented in the IcedID (BokBot) binary:

{
  "framing": "Standard HTTPS over TCP port 443. The stager issues an HTTP GET request to download a PNG image file. Embedded payload extraction occurs from pixel arrays or IDAT chunk data. Exfiltration and telemetry beacons are transmitted via encrypted cookie values in subsequent HTTP requests.",
  "serialization": "Binary struct serialized data, compressed via custom LZ routines and encoded into URL-safe base64 strings",
  "handshake": "Client establishes TLS session -> Issues GET /images/logo.png -> Receives HTTP 200 with PNG payload -> Extracts and decrypts core DLL -> Sends beacon request containing bot telemetry encoded within cookie fields (__gads, _gat) -> Server responds with encrypted command data",
  "cryptography": "TLS 1.2/1.3 transport encryption. Embedded payload within the PNG is encrypted using an 8-byte rolling XOR algorithm or modified RC4 cipher. Cookie values are encrypted with a session-specific XOR key.",
  "packet_types": [
    {
      "header": "GET /<path>/<image>.png",
      "payload": "Request fetching steganographic PNG carrier file",
      "direction": "Client -> Server"
    },
    {
      "header": "HTTP 200 OK (image/png)",
      "payload": "Valid PNG image containing hidden encrypted core module",
      "direction": "Server -> Client"
    },
    {
      "header": "POST /<path>/ (Cookie: __gads=...)",
      "payload": "Encrypted bot registration beacon containing HWID and system metadata",
      "direction": "Client -> Server"
    },
    {
      "header": "HTTP 200 OK",
      "payload": "Encrypted command block dispatching secondary execution tasks",
      "direction": "Server -> Client"
    }
  ],
  "traffic_signature": "Outbound HTTPS GET requests to third-party or compromised domains fetching valid image/png resources, followed by recurrent HTTPS requests bearing unusually large cookie strings (__gads, _gat) containing high-entropy Base64 data."
}

Indicators of compromise and forensic patterns recorded across laboratory triage: