Extracted

Extracted

• • Target

    497fa678528f8dc7dfaebe76f73061581f621d5eb2ed06e0c8b937a9131e9191

  • Size

    1.8MB

  • MD5

    d91d3dba1e492cdc999cd2f7d8a22c2e

  • SHA1

    d4b46c959754f8f00e136783429455feb434e373

  • SHA256

    497fa678528f8dc7dfaebe76f73061581f621d5eb2ed06e0c8b937a9131e9191

  • SHA512

    44b4fd513551176f7890bc3f6c4009087ada59f22594ab69807ef88e86d1e22aab498da30c160eb8aebdf21b11f2dd9c69ae8259b5da4489bd73e0f373607fdd

  • SSDEEP

    49152:p1PIEUo4HUzX3NZIYAaNtMMSmtS5Mu2AukpycABfB71cx:/hUnsQYAaNtnzS5/2xcAJhY

  Score

  10^/10

  adwindlokibotramnitsalitybackdoorbankercollectiondiscoveryevasionspywarestealertrojanupxwormpersistence

  • AdWind

    A Java-based RAT family operated as malware-as-a-service.

    trojanadwind

  • Adwind family

    adwind

  • Class file contains resources related to AdWind

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Lokibot family

    lokibot

  • Modifies firewall policy service

    evasion

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

    trojanspywarestealerwormbankerramnit

  • Ramnit family

    ramnit

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2