Extracted

• • Target

    b8254e8ce33d892fa181ae9d6bd03cbc6eefc0114a0b0614e7eda8accb4a90fe

  • Size

    284KB

  • MD5

    a29e65154935f9965830015d7b3478b0

  • SHA1

    5d36d94243010ca6e69939956566cd414bb0a265

  • SHA256

    b8254e8ce33d892fa181ae9d6bd03cbc6eefc0114a0b0614e7eda8accb4a90fe

  • SHA512

    391fe8bf11a7bf333c9c7842e0b515ccad7e317169cac1f723398422e15f0c24e090ba136e2948ecbdd31b5c62eb41b70e21f08b622bc725090522d542ff1ef6

  • SSDEEP

    6144:BBsxLVi2fLC/wch6f+NH4gP6poOZMTM2r:BBQLVBLeaAY6goOZMT/r

  Score

  10^/10

  ramnitsalitybackdoorbankerevasionspywarestealertrojanupxworm

  • Modifies firewall policy service

    evasion

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

    trojanspywarestealerwormbankerramnit

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Drops file in Drivers directory

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops file in System32 directory

  behavioral1behavioral2