IcedID Shows Obfuscation Sophistication in New Campaign

silversurfer

Level 85
Thread author
Verified
Helper
Top poster
Content Creator
Malware Hunter
Well-known
Aug 17, 2014
7,709
The malware's developers have turned to dynamic link libraries (DLLs) to hide their work.

IcedID is malware that, like many others, is constantly evolving to avoid detection. Recently, researchers found that the malware's developer had implemented a password-protected attachment, keyword obfuscation, and minimalist macro code in Trojanized documents. Now IcedID has gone even further, using a dynamic link library (.DLL) as part of its second-stage payload in an effort to stay off the anti-malware radar.

Researchers at Juniper Threat Labs found the latest IcedID malware uses a password-protected attachment in an email purporting to come from the accounting department to avoid initial signature detection. Once opened, the payload begins a process that includes two additional payload downloads, the first gaining persistence and the second launching a Trojan, with both using .DLL files to cloak their malware daggers.
Full report by researchers: