IcedID Shows Obfuscation Sophistication in New CampaignIcedID Shows Obfuscation Sophistication in New Campaign
The malware's developers have turned to dynamic link libraries (DLLs) to hide their work.
August 15, 2020
IcedID is malware that, like many others, is constantly evolving to avoid detection. Recently, researchers found that the malware's developer had implemented a password-protected attachment, keyword obfuscation, and minimalist macro code in Trojanized documents. Now IcedID has gone even further, using a dynamic link library (.DLL) as part of its second-stage payload in an effort to stay off the anti-malware radar.
Researchers at Juniper Threat Labs found the latest IcedID malware uses a password-protected attachment in an email purporting to come from the accounting department to avoid initial signature detection. Once opened, the payload begins a process that includes two additional payload downloads, the first gaining persistence and the second launching a Trojan, with both using .DLL files to cloak their malware daggers.
In announcing the malware, Juniper analysts note that DLL use is a mark of growing software sophistication for the coders developing the IcedID malware.
Read more here.
About the Author(s)
You May Also Like
Reducing Cyber Risk in Enterprise Email Systems: It's Not Just Spam and PhishingNov 01, 2023
SecOps & DevSecOps in the CloudNov 06, 2023
What's In Your Cloud?Nov 30, 2023
Everything You Need to Know About DNS AttacksNov 30, 2023
9 Traits You Need to Succeed as a Cybersecurity Leader
The Ultimate Guide to the CISSP
Modernize your Security Operations with Human-Machine Intelligence
The Cyber Threat Impact of COVID-19 to Global Business
Protecting Critical Infrastructure: The 2021 Energy, Utilities, and Industrials Cyber Threat Landscape Report