Extracted

• • Target

    NEAS.2023-09-05_affef3cffea158b73407806141853c28_icedid_JC.exe

  • Size

    2.0MB

  • MD5

    affef3cffea158b73407806141853c28

  • SHA1

    5b65137f13ed16f55ec31b2d38054887fe868a26

  • SHA256

    e6ea81fce1e2702c762307d2240fdd5c9b253ec4a8f2d355816e7ae71a949840

  • SHA512

    ec8cb0f712ede81512a4b1c8c67d855d8d7133ec848bff17ae629140a11e6ab6f64daacc0579c5357292f813ec06780bf921c95e8a1ebcd1bc4fbf9fe1ef5e2f

  • SSDEEP

    49152:n6AuUZ6cb4+h3JQY6x869D/hKhBTyyKXv8jFqelxXD26XwRANIX/vT:AUZF4+xzcnJhKhZVKXv2qelxXD26XwR7

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2