IcedID Shows Obfuscation Sophistication in New Campaign

IcedID is malware that, like many others, is constantly evolving to avoid detection. Recently, researchers found that the malware's developer had implemented a password-protected attachment, keyword obfuscation, and minimalist macro code in Trojanized documents. Now IcedID has gone even further, using a dynamic link library (.DLL) as part of its second-stage payload in an effort to stay off the anti-malware radar.

Researchers at Juniper Threat Labs found the latest IcedID malware uses a password-protected attachment in an email purporting to come from the accounting department to avoid initial signature detection. Once opened, the payload begins a process that includes two additional payload downloads, the first gaining persistence and the second launching a Trojan, with both using .DLL files to cloak their malware daggers.

In announcing the malware, Juniper analysts note that DLL use is a mark of growing software sophistication for the coders developing the IcedID malware.

Read more here.