Extracted

• • Target

    2024-01-25_5df5a9c2d4228d09eee1036cee92e478_icedid

  • Size

    1.4MB

  • MD5

    5df5a9c2d4228d09eee1036cee92e478

  • SHA1

    40ea1ab5a24ab1d331e3b5cebc8e15bfbd37c621

  • SHA256

    ae4b2cd95fc0e92ea80879a8af1166b67101308ea4969dd1d6853666e5d1c4e6

  • SHA512

    dbc969ece8a0425e2cbb15d9664226f9654dec6cfe2a188cde577b81e0809b94afd05230cecc8cb4cfb1d3b37f67ae1ce450d9b3d8f2ece4664e93c4fdb8a6f9

  • SSDEEP

    24576:zsD0nOGh29rgfdDvb4/1OiK4fghts67dHfdGMgpze8PdPAMkpb:NJXiK4Wts67h4npze81Pcpb

  Score

  10^/10

  salitybackdoorevasiontrojanupxkinsingloader

  • Kinsing

    Kinsing is a loader written in Golang.

    loaderkinsing

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2