Bokbot: The (re)birth of a banker

This Fox-IT technical analysis describes Bokbot (aka IcedID), a banking trojan observed from mid-2017 that appears linked to the Neverquest/Vawtrak actors; it covers Bokbot’s HTTPS/RC4/LZMAT communication, signed binary configs (bot/inject/reporting), bot/project ID formats, web-inject and dynamic redirect capabilities, geographic targeting (primarily North America), distribution via partners such as Geodo/Emotet and Chanitor, and its role in downloading additional malware (TheTrick, TinyLoader), concluding that Bokbot is an active, evolving criminal operation with strong underground affiliations and growing impact.