IconDown

Trojan downloaders are small hacking tools that cybercriminals use to deliver threatening payloads to their victims seamlessly. Often, these downloads rely on innovative techniques and tricks whose purpose is to obfuscate the program's true intentions and help it avoid anti-virus engines and other security measures. One of the Trojan downloaders to be seen in action recently is called IconDown, and it is used by a group of cybercriminals that are referred to as BlackTech frequently.

BlackTech is an Advanced Persistent Threat (APT) group that operates in Asia primarily, and their activities have been followed closely for more than a few years. The group targets businesses in various sectors frequently, and the IconDown campaign focuses on companies based in Japan. While this Trojan downloader serves a very basic purpose, the BlackTech threat actor has opted to use steganography to obfuscate the payload and its true intentions.

The IconDown Downloader Uses Steganography to Obfuscate Payloads

The IconDown's attack usually starts with the victim receiving a specially-crafted phishing email that contains a corrupted file attachment. The attachment in question might be an innocent-looking Microsoft Office document, but, in reality, it is meant to execute a macro script that decodes the IconDown payload and initializes it on the compromised host. Once this task is complete, the IconDown downloader will rely on steganography to fetch secondary payloads. The threat downloads an image from a remote host, and then looks for a specific string inside of it – this string was put in place by the threat actor, and it is meant to help the IconDown downloader to find the 256 bytes of data that are used as an RC4 key. Once the key is retrieved, IconDown will use it to decrypt the rest of the data found in the bogus image file – the result is compiled in a PE (Portable Executable) file and executed.

Companies targeted by the BlackTech group can protect their networks by investing in reputable anti-virus products, besides taking the needed steps to block connections to the Command and Control servers that the threat actors are known to use.