IcedID Shows Obfuscation Sophistication in New Campaign

[silversurfer]

Content source

https://www.darkreading.com/attacks-breaches/icedid-shows-obfuscation-sophistication-in-new-campaign/d/d-id/1338678

The malware's developers have turned to dynamic link libraries (DLLs) to hide their work.

IcedID is malware that, like many others, is constantly evolving to avoid detection. Recently, researchers found that the malware's developer had implemented a password-protected attachment, keyword obfuscation, and minimalist macro code in Trojanized documents. Now IcedID has gone even further, using a dynamic link library (.DLL) as part of its second-stage payload in an effort to stay off the anti-malware radar.

Researchers at Juniper Threat Labs found the latest IcedID malware uses a password-protected attachment in an email purporting to come from the accounting department to avoid initial signature detection. Once opened, the payload begins a process that includes two additional payload downloads, the first gaining persistence and the second launching a Trojan, with both using .DLL files to cloak their malware daggers.

Full report by researchers:

IcedID Campaign Strikes Back | Official Juniper Networks Blogs

In our previous blog about IcedID, we explored some of the changes in the malware and how it tries to evade detection. We also detailed how threat actors took advantage

blogs.juniper.net