Extracted

• • Target
    0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118
  • Size 255KB
  • SHA256 c774f3dca844e6fc31b1b23328fcc10860f30d2fccab118bea20d601779ae112
  • MD5 0e0b392d511d9c14d51fff720b3f3d9e
  • SHA1 a7e78a574012637e6c300dba2f482a94e6ecfb65
  • SHA512 d003310d9ece75978b4c18f5f735da935db4411df3898a6d2df0289260780d1116347ebd186951d052fd25b18e61bf4c50777d8e559584651cff210932a4cbad
  • SSDEEP 3072:HunxwgxgfR/DVG7wBpErzWRVoYc0WnqAdelWGPRSOLjK+ca1x:G+xDVG0BpE+lAvepSOLjAMx
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  ramnitsalitybackdoorbankerpersistencespywarestealertrojanupxwormevasion

  • Modifies WinLogon for persistence

    persistence

  • Modifies firewall policy service

    evasion

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

    trojanspywarestealerwormbankerramnit

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops file in System32 directory

  behavioral1behavioral2