Extracted

• • Target

    194ffa67a5d575c6044afd1f74f2cb5aea42cb3dc4e02478485075b81eb3bff6N

  • Size

    895KB

  • MD5

    354d4c7631799b079aacc47e1d8d6580

  • SHA1

    4181e101259c036b5c87311b6958f8a90f3bcab9

  • SHA256

    194ffa67a5d575c6044afd1f74f2cb5aea42cb3dc4e02478485075b81eb3bff6

  • SHA512

    168993c7c523dbb8200d359ef23f2160c3de0da616eb5827525ca4ce4a970c0bf2849b00578241bfef608838c7b340ff6e18ec4524da98232ca338b14df9762a

  • SSDEEP

    12288:KwCBtLC+EptUpQ9SeSChq3YvxFBSSRMT8PTp4ahozEo888888888888W8888888/:qNzCtUpQ9WWPBSSRMTEprNffLVRE

  Score

  10^/10

  renamersalitybackdoordiscoveryevasiontrojanupxworm

  • Detects Renamer worm.

    Renamer aka Grename is worm written in Delphi.

  • Modifies firewall policy service

    evasion

  • Renamer family

    renamer

  • Renamer, Grenam

    Renamer aka Grenam is a worm written in Delphi.

    wormrenamer

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Drops startup file

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2