Extracted

• • Target

    01f8921b32819f8efdb25e528ab4fc41e8096ded044ea94a7bad41d91b931404

  • Size

    629KB

  • MD5

    8418bc99d7f0f7ec5b1c7144571574b0

  • SHA1

    2705e660ecc823adf76c28c60d78d68459e42ad5

  • SHA256

    01f8921b32819f8efdb25e528ab4fc41e8096ded044ea94a7bad41d91b931404

  • SHA512

    bb74da562ba3e35b622989f0b7050f294dcca992e92a533d8968b9d8b05a4f307d0365ea166f99d7a49d0be9f5371bf4b6b3acfa93c01fdaac8c121082b3308c

  • SSDEEP

    12288:IeoGiLaSXGAiN6Ezpe56qoACjox48EbyIto4YSK1JBQKQ:hQL5tMikmCjoqnXtGxJW

  Score

  10^/10

  ramnitsalitybackdoorbankerevasionspywarestealertrojanupxworm

  • Modifies firewall policy service

    evasion

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

    trojanspywarestealerwormbankerramnit

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2