In the recent campaign we observed several changes to the IcedID Trojan.

https://securelist.com/malicious-spam-campaigns-delivering-banking-trojans/102917/