Extracted

• • Target

    2024-12-15_61fb0420e4b1760d8f8be0fd074d3d6a_icedid

  • Size

    1.1MB

  • MD5

    61fb0420e4b1760d8f8be0fd074d3d6a

  • SHA1

    894b6d05b180d024fb538623071c806d766d1fac

  • SHA256

    e2d0cd5a3a2b2df6bfb1a89fea0783fab489f052e446e172e0dec739a25740dd

  • SHA512

    e746f80b04d9bf752582f61729eda0553413c40286abec2ba66a88604753be24c12e5b1e3c57e668ea32d1b317357c8a123eef3868ea5beebefc7a86f74de73e

  • SSDEEP

    24576:sZT2K+zRJiT1DQzICqs4DJcahFVpdCX/xXubMy:A27RJ4DQzICqLJcEVdCX/x/y

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Windows security modification

    evasiontrojan

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2