IcedID Malware Distributed from Fake Zoom Installation Website

12 Dec
Attacks, Malware

As of December 12th, the malicious website was still active and serving malware installation files. Binary Defense analysts noted that the malware installation program, named “ZoomInstallerFull.exe” drops a legitimate, signed copy of the real Zoom software installer as a Microsoft Installer package file named “ikm.msi” and installs it. It also drops a malicious DLL file named “ikm.aaa” and runs it via rundll32.exe. The DLL file was identified as IcedID. The Command and Control (C2) server contacted by this sample is ewgahskoot[.]com