H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[IcedID](https://attack.mitre.org/software/S0483) is a modular banking malware designed to steal financial information that has been observed in the wild since at least 2017. [IcedID](https://attack.mitre.org/software/S0483) has been downloaded by [Emotet](https://attack.mitre.org/software/S0367) in multiple campaigns.(Citation: IBM IcedID November 2017)(Citation: Juniper IcedID June 2020)

Labels

malware

34 recorded

Relationships

uses

to Asymmetric Cryptography

Technique

uses

to Asynchronous Procedure Call

Technique

uses

to Browser Session Hijacking

Technique

uses

to Domain Account

Technique

uses

to Domain Trust Discovery

Technique

uses

to Drive-by Compromise

Technique

uses

to Embedded Payloads

Technique

uses

to Encrypted/Encoded File

Technique

uses

to Exfiltration Over Asymmetric Encrypted Non-C2 Protocol

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Malicious File

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

Technique

uses

Technique

uses

to Network Share Discovery

Technique

uses

to Permission Groups Discovery

Technique

uses

to Process Hollowing

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

Technique

uses

to Scheduled Task

Technique

uses

to Security Software Discovery

Technique

uses

to Software Packing

Technique

uses

to Spearphishing Attachment

Technique

uses

to Steganography

Technique

uses

to System Information Discovery

Technique

uses

to System Language Discovery

Technique

uses

to System Network Configuration Discovery

Technique

uses

to Virtualization/Sandbox Evasion

Technique

uses

to Visual Basic

Technique

uses

to Web Protocols

Technique

uses

to Windows Management Instrumentation

Technique

uses

from TA551

Group

uses

from TA578

Group

uses

from Water Curupira Pikabot Distribution

Campaign

3 external

References

mitre-attack

S0483

IBM IcedID November 2017

https://securityintelligence.com/new-banking-trojan-icedid-discovered-by-ibm-x-force-research/

Juniper IcedID June 2020

https://blogs.juniper.net/en-us/threat-research/covid-19-and-fmla-campaigns-used-to-install-new-icedid-banking-malware