Extracted

• • Target

    2024-05-28_8f913398b21de0240c45044e6b885699_icedid

  • Size

    11.4MB

  • MD5

    8f913398b21de0240c45044e6b885699

  • SHA1

    b4cb1b28458866bbaa1612d6025bcb46645ae1a6

  • SHA256

    77fcd78a7ab268425e4bc5868a1e70a4cd0af1692d32f00dacc31cd6e68ba5f2

  • SHA512

    d3af4bd855d2836d6efe4ace741fe6fe19eacc34f477a17822640b8b3458036272d1f8f77c84ed12be7e128fd695d4c9f1aadf41247b392486de25e78f38f529

  • SSDEEP

    98304:1aAklTuv1cqBEJKfueVA8LsKv2ZwmIRrWmtslQ7OMCToaLGJxBRPIp2zocB9IwfT:O4cqSJKfueFT3Ymt2yOHTHaxRWcUdaX

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2