Extracted

• • Target

    NEAS.ed999579745c2dc0f23ea408945613f0_JC.exe

  • Size

    564KB

  • MD5

    ed999579745c2dc0f23ea408945613f0

  • SHA1

    abf786a0d230a464d65d3d400bacea88e2e986f7

  • SHA256

    eee21545e047f4308974d92f4d8eb6debe610c571a1a9023f3bf889d0fedbfe9

  • SHA512

    d0ebf1a77cd07ce1ed3294a9a03ca63c53b2245a2e6fc42d5c4c949d65a8cee1f884d1d49f37b9c267664692d8c2d1bd7eba7963686f5798d9d9a652853e9d56

  • SSDEEP

    12288:tehnaNPpSVZmNxRCwnwm3W3OHIIf5m9RhWFVo:teh0PpS6NxNnwYeOHXAhWTo

  Score

  10^/10

  ramnitsalitybackdoorbankerevasionpersistencespywarestealertrojanupxworm

  • Modifies WinLogon for persistence

    persistence

  • Modifies firewall policy service

    evasion

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

    trojanspywarestealerwormbankerramnit

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops file in System32 directory

  behavioral1behavioral2