Extracted

• • Target

    2024-04-16_d5bfe20d5faf0e1fd21352cd5c301705_icedid

  • Size

    4.0MB

  • MD5

    d5bfe20d5faf0e1fd21352cd5c301705

  • SHA1

    f70675c9e3449931763e02473859e81f5dfa42a4

  • SHA256

    990c0d4c483f48ab674323f2af077520ec1e2d572eff6aa6cf683788fda462d4

  • SHA512

    ffd08c9027134f5cd3f025a283a76b812ae4f9079d77e563a21cb3338a4b19a18a9e92b9d0b198852962fa5eb648a081eb01c3205acb8c1e6e363d07aead7aa8

  • SSDEEP

    12288:p1V5z4orgIEI2Q/Q1PoZx+BC+ZbXIrW0iI:pJzLEIR3H+uW0iI

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • Detects executables packed with VMProtect.

  • UPX dump on OEP (original entry point)

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2