Extracted

• • Target

    7c260f14546ebba1cbf0a1c3a4ef0656c5c69b19b4187e9e6eaf99d8b74265cd

  • Size

    304KB

  • MD5

    a1360f1e53f9b27a3b07de8ce7f18870

  • SHA1

    881ff5bc1498f8ed7901590cdcdfbd0310391bf1

  • SHA256

    7c260f14546ebba1cbf0a1c3a4ef0656c5c69b19b4187e9e6eaf99d8b74265cd

  • SHA512

    0510bbf9e1eaa28be71345c227fa1ada50e7f1682d4590e6bd4a507ff253dcae17ed745108c17ec084bfc9595fbf7f645a4c9d94943368d58a37f023a9a74852

  • SSDEEP

    6144:NBdy3LvX+1FluUmeMW4vhmBMCe1MeTGoAy4ZtFDZuTQIYBXTAn:NLy3zu1Fl/MYBMCe1jGo34ZbT+

  Score

  10^/10

  ramnitsalitybackdoorbankerevasionspywarestealertrojanupxworm

  • Modifies firewall policy service

    evasion

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

    trojanspywarestealerwormbankerramnit

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops file in System32 directory

  behavioral1behavioral2