Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.
IcedID Shows Obfuscation Sophistication in New Campaign
The malware's developers have turned to dynamic link libraries (DLLs) to hide their work.
1 Min Read
IcedID is malware that, like many others, is constantly evolving to avoid detection. Recently, researchers found that the malware's developer had implemented a password-protected attachment, keyword obfuscation, and minimalist macro code in Trojanized documents. Now IcedID has gone even further, using a dynamic link library (.DLL) as part of its second-stage payload in an effort to stay off the anti-malware radar.
Researchers at Juniper Threat Labs found the latest IcedID malware uses a password-protected attachment in an email purporting to come from the accounting department to avoid initial signature detection. Once opened, the payload begins a process that includes two additional payload downloads, the first gaining persistence and the second launching a Trojan, with both using .DLL files to cloak their malware daggers.
In announcing the malware, Juniper analysts note that DLL use is a mark of growing software sophistication for the coders developing the IcedID malware.
Read more here.
About the Author
You May Also Like
More Insights
Webinars
