Extracted

• • Target

    2024-05-22_44657a8b74f66eeac1b740096c60ddf6_icedid

  • Size

    1.9MB

  • MD5

    44657a8b74f66eeac1b740096c60ddf6

  • SHA1

    29edfd7faabc9b8892e024b01d310713df0319d8

  • SHA256

    215e033c15a2242c3dab802f0c71964ceedb9d903f3e5e7f8b28bf0c82631542

  • SHA512

    297af316011b5bbb1c5421a56517a8f85833eabea6c411ddcf100aa4c9acf77023b3909ab1fa759f7a112d2e35d12150e4dcfce2ead93f396972e9461662d0eb

  • SSDEEP

    24576:v3eIenKQZrLeaU7N8d5FcVMYPsk28NFgCXX0B2ySzG3NaW:vYnLtLed0qET8NFgdBGId

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2