IcedID Shows Obfuscation Sophistication in New CampaignIcedID Shows Obfuscation Sophistication in New Campaign

IcedID is malware that, like many others, is constantly evolving to avoid detection. Recently, researchers found that the malware's developer had implemented a password-protected attachment, keyword obfuscation, and minimalist macro code in Trojanized documents. Now IcedID has gone even further, using a dynamic link library (.DLL) as part of its second-stage payload in an effort to stay off the anti-malware radar.

Researchers at Juniper Threat Labs found the latest IcedID malware uses a password-protected attachment in an email purporting to come from the accounting department to avoid initial signature detection. Once opened, the payload begins a process that includes two additional payload downloads, the first gaining persistence and the second launching a Trojan, with both using .DLL files to cloak their malware daggers.

In announcing the malware, Juniper analysts note that DLL use is a mark of growing software sophistication for the coders developing the IcedID malware.

Read more here.