Extracted

Extracted

• • Target

    c191595a7ab6af9541dadd4b6544c9b65a9e5fa76f49836d1f3fc28a50c0459f.exe

  • Size

    464KB

  • MD5

    5ff1999425fe352ee7fe4d1eb995a2fe

  • SHA1

    2cb44adb130a1316010cee3e54dbbc432f40d807

  • SHA256

    c191595a7ab6af9541dadd4b6544c9b65a9e5fa76f49836d1f3fc28a50c0459f

  • SHA512

    58bb4d99c717a52fe7cd516eb6a1db45428e666788742d452eae902a80391ccb8249f40bd05a2c2f79826d0c744859e8b2c85e0d4578867cf2ff5ab6acceb4f1

  • SSDEEP

    6144:5Sl3cEjScqKbDFrXNAvJ3BEXDhI0ifpxzxGqW7qcRa9Br7ierTrD9f5jxZ8YFYZH:QlsEGZK1SB30mRG9mcrefJ1bXCtsdu

  Score

  10^/10

  ramnit9��bankerexecutionpersistencespywarestealertrojanworm

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

    trojanspywarestealerwormbankerramnit

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2