Extracted

• • Target

    5bfc2c9fa92025c8353e887c64796110N.exe

  • Size

    564KB

  • MD5

    5bfc2c9fa92025c8353e887c64796110

  • SHA1

    c9406a3387b30c15e1997746832a1e6a3b396db6

  • SHA256

    ecfacdf9186ee26b063dfa26161a07643838d9d89a457b19aaf8e84494a2be09

  • SHA512

    a1ed9651c0b23bb6383b38237bbcaf3ddbd91800b773a1ba2977ab3983e91d752478360171a58728fd23e5670d978a302c35437cc35dd46436948a9c2631aea4

  • SSDEEP

    12288:tehnaNPpSVZmNxRCwnwm3W3OHIIf5m9RhWFVv:teh0PpS6NxNnwYeOHXAhWTv

  Score

  10^/10

  salitybackdoordiscoveryupxramnitbankerevasionspywarestealertrojanworm

  • Modifies firewall policy service

    evasion

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

    trojanspywarestealerwormbankerramnit

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops file in System32 directory

  behavioral1behavioral2