Extracted

• • Target

    2024-12-25_c899090b1be17bf681f5ea2acedf329b_icedid

  • Size

    1.3MB

  • MD5

    c899090b1be17bf681f5ea2acedf329b

  • SHA1

    d63075f2efd4585d961f0a0b0702c943035a25cc

  • SHA256

    0dfb4fa511c8bc2219fa8753b0b5668a29dc7a80f3945da4ab792e829ce38c5d

  • SHA512

    211fbfb261994101b76ad8255794e83e59a74986c4153e375c7842debcfb61d7fb3507f3de977d1022a6d30bafc0201935adf17b3d95ba6b245335055f4bcc40

  • SSDEEP

    24576:v+qCUgiJkfz6lM/7nqMf3K2+T3MGFWqaPknzREC:ewkfUAmT3MGFWCEC

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2