Extracted

• • Target

    2024-05-28_6971cac8fde889e60db80b3fd1459bd4_icedid

  • Size

    540KB

  • MD5

    6971cac8fde889e60db80b3fd1459bd4

  • SHA1

    59a4c8c7aca06a36bc604adf34fb5c68b31d6380

  • SHA256

    2ade203955609ce4677c0489f752de231b3602f5d237c4bcf67474af90f0f58f

  • SHA512

    710a6196d39ebc7eb948ac56491468c371ce034d2d53f03d3ce04450abeee0aaa6b2b5446f1824c604c131afc169b4268d8a7bc31f355d3703df4d0dec78ed4c

  • SSDEEP

    12288:sRil+i/ORc/mKw/RZAfwgm1lJq/CnU4vGr69rlzh2:5b/ORcG4w7bqan5eylz0

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2