As cited
Copy frozen at (site build).
threat intel
Unpacking ICEDID
No summary had been written when this copy was frozen.
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
Unpacking ICEDID
Elastic Security Labs released analysis tools and open source utilities to unpack ICEDID, a malware family that steals credentials and banking information using custom file formats and encryption. The research covers the GZip variant execution chain, including extraction of encrypted payloads, decryption, core binary reconstruction, and analysis of embedded modules such as browser hooking capabilities. Practitioners can now use the released nightMARE library and Python scripts to automate malware unpacking and enable faster incident response.
Why it matters: Security analysts and incident response teams handling ICEDID samples can now rapidly extract, decrypt, and analyze payloads without manual reverse engineering, reducing time to identify command and control (C2) domains, configuration data, and secondary malware like DarkVNC or Cobalt Strike.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
Unpacking ICEDID
Elastic Security Labs released analysis tools and open source utilities to unpack ICEDID, a malware family that steals credentials and banking information using custom file formats and encryption. The research covers the GZip variant execution chain, including extraction of encrypted payloads, decryption, core binary reconstruction, and analysis of embedded modules such as browser hooking capabilities. Practitioners can now use the released nightMARE library and Python scripts to automate malware unpacking and enable faster incident response.
Why it matters: Security analysts and incident response teams handling ICEDID samples can now rapidly extract, decrypt, and analyze payloads without manual reverse engineering, reducing time to identify command and control (C2) domains, configuration data, and secondary malware like DarkVNC or Cobalt Strike.
- Source published
- First seen by Cybersecurity Tracker