Rewterz Threat Alert – IcedID Used Steganography to Hide Payload

Severity

Medium

Analysis Summary

While investigating a recent malspam campaign that targeted the United States and distributed the IcedID Trojan, researchers from Malwarebytes Labs noticed some changes, one of which was the payload being delivered using steganography. The payload data is encrypted and encoded within a PNG image file. The email in the malspam campaign had the subject line of “USPS Delivery Unsuccessful Attempt Notification” and had attached to them a Word document that contained malicious macros. If the email recipient opened the document and enabled macros, the end result would be the installation of the IcedID Trojan. Persistence is achieved using a scheduled task. IcedID will inject implants into web browsers in order to steal financial information. It also steals other information such as credentials from various applications and cookies. IcedID can also, on instructions from its C&C server, install additional malware.

Impact

• Credential theft
• Financial loss

Indicators of Compromise

MD5

• 29E709CEB0FA00ED56CD9E3CED4FDC70
• 407CDE16473474C15F66651307E42D9B

SHA-256

• 58c8518a85d32448881050757f6a8b0468636d3ebb74315023d9963b32355501
• 7aa3ef953f07267af9389d26ce7214cfcef453436c7dee78f39b924d21312464

SHA1

• 8afbecd6f857f4e512193449864326518648d3b0
• c66bede3d34261c2b86fb9f1d75ac5059c4233b9

URL

• http://104.168.198.230/wordupd.tmp

Remediation

• Block all threat indicators at your respective controls.
• Always be suspicious about emails sent by unknown senders.
• Never click on the links/attachments sent by unknown senders.