Extracted

• • Target

    2024-05-28_76ce96b010840b50bc75131ac1775a19_icedid

  • Size

    6.1MB

  • MD5

    76ce96b010840b50bc75131ac1775a19

  • SHA1

    27a76e71525d3031a04ab9d8d0ba881d7830309d

  • SHA256

    999130321e88b3ff5906b1ead86115ff7f979939c810a4a6654fe1ef6df5843e

  • SHA512

    a9ef324b34797cc62e050bfb79a917716b498e8fe4d0295c01781c6cf9de3697f7bda73d58fc7227507bf2c7be6793c1959a997f0a1ef71a98fb2e807d86c382

  • SSDEEP

    49152:VPAPQZCL5NwrTGaSHxDQtxUffJBEagtR+QjfAPR0F:x3CrwrSaoxDdffVgtRdCI

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2