Trojan.IcedID.ZB

Trojan.IcedID.ZB is a detection for a variant of IcedID — a well-known banking trojan and malware loader that is also tracked under the name BokBot. First identified by security researchers in 2017, IcedID has evolved from a straightforward online-banking credential stealer into a modular delivery platform that is frequently used as the first stage of larger, human-operated ransomware attacks.

Once active on a Windows system, IcedID quietly monitors the victim's web activity, harvests banking and account credentials, and reaches out to a remote command-and-control (C2) server to fetch additional malicious modules. Because it doubles as a loader, an IcedID infection should never be treated as a single, isolated problem — it is often the visible symptom of a broader compromise.

What Is IcedID?

IcedID belongs to the family of financial trojans built primarily to steal money. It specializes in web injection and man-in-the-browser techniques: rather than crudely redirecting a victim to a fake site, it keeps the connection to the legitimate bank open — preserving the real URL and SSL certificate — while silently capturing the login details the user types. Those credentials are sent straight to the attacker's server, where they can be used to hijack the account and initiate fraudulent transfers.

How IcedID Spreads

IcedID is most often delivered through malicious spam (malspam) campaigns that carry booby-trapped Office documents, password-protected archives, or ISO/LNK files. It is also dropped by other malware as part of a pay-per-install ecosystem. Opening the lure and enabling content triggers a small initial loader, which contacts a C2 server and downloads the full IcedID payload.

What Trojan.IcedID.ZB Does

• Credential theft: intercepts online-banking and account logins through browser injection.
• Loader activity: downloads and runs follow-on malware, including remote-access tools and ransomware.
• Persistence and stealth: samples of this variant typically carry no valid digital signature, a common trait of malicious binaries trying to blend in.
• Reconnaissance: profiles the infected machine and network to help operators decide whether to escalate the attack.

Symptoms of Infection

• Unexplained banking activity or fraudulent transactions.
• Unfamiliar processes running in the background and unexpected network connections.
• Security software being disabled or additional malware appearing on the system.

Why IcedID Is Dangerous

IcedID's combination of banking fraud and malware delivery makes it especially serious. A single infection can lead directly to drained bank accounts, and because IcedID has repeatedly served as an entry point for ransomware crews, an unaddressed infection can escalate into full network encryption. The Threat Scorecard and behavioral Analysis Report shown on this page summarize how SpyHunter's research systems rank and observe this threat.

How to Remove IcedID

Because this threat runs as a file-based Windows infection, removal has two goals: stop the malicious process and delete every component it dropped, then confirm nothing was left behind to reinstall it.

Manual Steps

1. Disconnect the computer from the internet to cut the malware off from its command-and-control server.
2. Restart Windows in Safe Mode with Networking so the threat is not loaded at startup.
3. Open Task Manager and end any unfamiliar or suspicious background processes.
4. Check Settings → Apps and uninstall any program you do not recognize or did not intentionally install.
5. Review startup entries (Task Manager → Startup) and the Run registry keys for entries that point to random file names in temporary folders.
6. If you bank online, assume your credentials are compromised: from a clean device, change your banking and email passwords and enable multi-factor authentication.
7. Clear temporary files to remove staging copies of the payload.

Recommended: Run a Full Malware Scan

Manual removal is difficult because modern threats hide components and can restore themselves. The most reliable way to fully remove IcedID and any additional malware it may have downloaded is to scan the system with a professional, up-to-date anti-malware tool such as SpyHunter. A complete scan will detect and remove the threat's files, registry entries, and related infections, helping restore the device to a clean, secure state.

Conclusion

Trojan.IcedID.ZB is not a minor annoyance — it is a foothold for financial theft and further compromise. Remove it promptly, treat any credentials entered on the infected machine as stolen, and scan the system with a trusted security tool to ensure no secondary payloads remain.