IcedID: new malware version

What did malware analysts think when they first heard the words IcedID and BokBot? Undoubtedly things like:

web injects, proxy servers, quick version updates… The updates were sometimes so fast that while analysts were studying the current version, a new one would emerge. Do you know what feature has been added to this list? A steganography downloader. But what if I told you that, in the new version, not only the main IcedID module is hidden in an image, but also its configuration files? Have I sparked your interest? Let’s take a closer look at the new malware version.

IcedID was first described in November 2017 by IBM X-Force researchers. At the time, the application b…