Extracted

• • Target

    431f823178c3ea2a167b5e9ca580c7177b16cfb6414e1cd60276b15feafdb717

  • Size

    238KB

  • MD5

    5138aa193e15d72e587063e736ff4fcf

  • SHA1

    8dcbc55ab959de9aa7a1d038c700c2787996d48c

  • SHA256

    431f823178c3ea2a167b5e9ca580c7177b16cfb6414e1cd60276b15feafdb717

  • SHA512

    9cd95264a0802ad63ef7c764c49b6ea710c02933b1f1630a08abeed62055f5605e5a965f9dace8a7e1c06762e5b3fb17b720d00ac621ffe98aecb787ef98fb2e

  • SSDEEP

    6144:+BPW5fiNjmCI/y+5HJR8PIIcKK9Kpl1qNwz/RcGsxlv9Ed:qP6aVmvx5HwPIFLI4NwTeGsxHE

  Score

  10^/10

  ramnitsalitybackdoorbankerevasionspywarestealertrojanupxworm

  • Modifies firewall policy service

    evasion

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

    trojanspywarestealerwormbankerramnit

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2