IcedID Trojan Uses Steganographic Payloads

[Teddy Rogers]

Quote

Security firm Proofpoint recently published a report about a series of malspam campaigns they attribute to a threat actor called TA2101. Originally targeting German and Italian users with Cobalt Strike and Maze ransomware, the later wave of malicious emails were aimed at the US and pushing the IcedID Trojan.

In this blog post, we take a closer look at these new payloads and describe their technical details.

https://blog.malwarebytes.com/threat-analysis/2019/12/new-version-of-icedid-trojan-uses-steganographic-payloads/

Ted.