Extracted

• • Target

    6820018b96828ea11d46717babce7866107d6a9f8696d2ea30e4cc24b7738083

  • Size

    1.8MB

  • MD5

    2cb81b12de4a87139a4c19468341780c

  • SHA1

    22897ebc0a9dfc67cb6bb985253e73338f844192

  • SHA256

    6820018b96828ea11d46717babce7866107d6a9f8696d2ea30e4cc24b7738083

  • SHA512

    c1c586019e8e1e4ecb41991e34284881e5113903f0209259c271b62e894e708660a715b8787ab6659213f2fba4b0fbc13cdf866e529c7c938bc2c86586059b7d

  • SSDEEP

    49152:ujZxx4CnLdGOTalVz9vKxRwblCvQ3g7c39j5JMX/ECZViEJkT:SDmPNB8I3g7cNjnMPXZVET

  Score

  10^/10

  ramnitsalitybackdoorbankerevasionspywarestealertrojanupxworm

  • Modifies firewall policy service

    evasion

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

    trojanspywarestealerwormbankerramnit

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2