Extracted

• • Target

    2024-05-04_304932ba65468396117974ec69e5b978_icedid

  • Size

    4.7MB

  • MD5

    304932ba65468396117974ec69e5b978

  • SHA1

    63f46823fb680d145ad18a4aea99727c13081864

  • SHA256

    b9341448e32dc31838a791056ba5125daccaa4bf038674d4f0538606808d31b4

  • SHA512

    8b6c3897858822c1832a48a2a722f3189965d194260067462d2b0253faf9beb067c64a518276f66c7651c51ad34d1d0fb1cd0dea729b53fc29d68b99dbe6254e

  • SSDEEP

    98304:aGjGrluTYyCfZQVc6VRxzPia3TjX59n46G0HbMuvWDDjdtbaM+2yoF:aGjGhuUxf96nxzKWl46t7MuO75yoF

  Score

  10^/10

  salitybackdoordiscoveryevasionspywarestealertrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2