Extracted

• • Target

    a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26

  • Size

    1.4MB

  • MD5

    1bc1e1954201da6878f6346a96db23a5

  • SHA1

    d6b573c42cfde3e65c3b13bad483a49542b9f334

  • SHA256

    a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26

  • SHA512

    fe29627c12470176f088c465daa1692e089c1309e4f393243f24b0b9941151a7ba934dddaf52d83cac2006f6fb36d5c53a7298408b6d993a9751e7a6141655cb

  • SSDEEP

    24576:U5v0UtYJN3UAEny0oRwVZlCvQ3cRB7aBq3U9T3Ga2vRwXz9FnEQs4ZuaiMpHJJ8D:oj23d9DRwblCvQ3g7c39jsiX/ECZViE4

  Score

  10^/10

  ramnitsalitybackdoorbankerevasionspywarestealertrojanupxworm

  • Modifies firewall policy service

    evasion

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

    trojanspywarestealerwormbankerramnit

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2