While investigating a recent malspam campaign that targeted the United States and distributed the IcedID Trojan, researchers from Malwarebytes Labs noticed some changes, one of which was the payload being delivered using steganography. The payload data is encrypted and encoded within a PNG image file. The email in the malspam campaign had the subject line of “USPS Delivery Unsuccessful Attempt Notification” and had attached to them a Word document that contained malicious macros. If the email recipient opened the document and enabled macros, the end result would be the installation of the IcedID Trojan. Persistence is achieved using a scheduled task. IcedID will inject implants into web browsers in order to steal financial information. It also steals other information such as credentials from various applications and cookies. IcedID can also, on instructions from its C&C server, install additional malware.